Skip to main content

Responsible Disclosure & Security Guidelines

HackAgent is a powerful security testing framework designed to help identify vulnerabilities in AI systems. With this power comes responsibility. This guide outlines the ethical and legal considerations for using HackAgent responsibly.

🛡️ Core Principles​

1. Authorization First​

NEVER test systems without explicit permission

  • ✅ Your own AI agents and systems
  • ✅ Systems you own or operate
  • ✅ Authorized penetration testing engagements with written permission
  • ✅ Research environments with proper approval
  • ❌ Third-party systems without permission
  • ❌ Production systems without approval
  • ❌ Systems owned by others

2. Minimize Harm​

Testing should not cause damage or disruption

  • ✅ Use minimal test cases to demonstrate vulnerability
  • ✅ Avoid overwhelming systems with excessive requests
  • ✅ Stop testing once vulnerability is confirmed
  • ❌ Don't attempt to access sensitive data beyond proof-of-concept
  • ❌ Don't disrupt normal system operations
  • ❌ Don't delete or modify data

3. Respect Privacy​

Protect user data and privacy at all times

  • ✅ Use synthetic or dummy data for testing
  • ✅ Immediately delete any accidentally accessed personal data
  • ✅ Report data exposure without accessing the data
  • ❌ Don't attempt to access personal information
  • ❌ Don't store or share discovered sensitive data
  • ❌ Don't use real user data in tests

📋 Pre-Testing Checklist​

Before using HackAgent, ensure you can answer YES to all these questions:

  • Do I have explicit written permission to test this system?
  • Have I identified the appropriate contact for security issues?
  • Do I understand the system's acceptable use policy?
  • Am I prepared to report findings responsibly?
  • Do I have a plan to minimize potential harm?
  • Am I complying with applicable laws and regulations?

🔍 Vulnerability Discovery Process​

Phase 1: Preparation​

  1. Document Permission: Keep written authorization for your testing
  2. Identify Contacts: Know who to contact for security issues
  3. Plan Testing: Define scope and limitations of your testing
  4. Set Boundaries: Establish what you will and won't test

Phase 2: Testing​

  1. Start Small: Begin with minimal, non-invasive tests
  2. Document Everything: Keep detailed records of your testing
  3. Monitor Impact: Watch for any negative system effects
  4. Stop at Discovery: Cease testing once vulnerability is confirmed

Phase 3: Reporting​

  1. Report Promptly: Contact the responsible party quickly
  2. Provide Details: Include clear reproduction steps
  3. Suggest Fixes: Offer remediation suggestions when possible
  4. Follow Up: Maintain communication throughout the process

📧 Responsible Disclosure Process​

1. Initial Discovery​

When you discover a vulnerability using HackAgent:

IMMEDIATELY:

  • Stop further exploitation attempts
  • Document the vulnerability with minimal proof-of-concept
  • Do not access sensitive data or disrupt services
  • Begin the disclosure process

2. Contact the Vendor/Owner​

Preferred Contact Methods (in order):

  1. Security Email: security@company.com
  2. Bug Bounty Program: Vendor's designated platform
  3. Direct Security Contact: Named security personnel
  4. General Contact: info@company.com with "SECURITY" subject

Initial Disclosure Email Template:

Subject: Security Vulnerability Report - [Brief Description]

Dear Security Team,

I am a security researcher and have discovered a potential vulnerability 
in your AI system while conducting authorized security testing using 
HackAgent (an open-source AI security testing framework).

VULNERABILITY SUMMARY:
- System: [System name/URL]
- Type: [e.g., Prompt Injection, Jailbreak]
- Severity: [Your assessment]
- Discovery Date: [Date]

IMPACT:
[Brief description of potential impact]

I would like to work with your team to resolve this issue responsibly.
I can provide detailed technical information and reproduction steps
once we establish secure communication.

Please respond within 5 business days to acknowledge receipt of this
report and provide guidance on next steps.

Thank you for your time and commitment to security.

Best regards,
[Your name]
[Your contact information]

3. Coordinated Disclosure Timeline​

Standard Timeline:

  • Day 0: Initial vulnerability report
  • Day 5: Vendor acknowledgment expected
  • Day 10: Detailed technical information shared
  • Day 30: Vendor provides initial fix timeline
  • Day 90: Public disclosure (if fixed) or discussion of extended timeline

Factors for Timeline Adjustment:

  • Severity: Critical vulnerabilities may need faster resolution
  • Complexity: Complex fixes may require more time
  • Vendor Response: Cooperative vendors may get extended timelines
  • Public Risk: Active exploitation may accelerate disclosure

4. Public Disclosure​

Before Public Disclosure:

  • Ensure vendor has had adequate time to fix
  • Verify the fix is effective
  • Coordinate disclosure timing with vendor
  • Prepare educational content about the vulnerability class

Public Disclosure Should Include:

  • High-level vulnerability description
  • Impact assessment
  • Timeline of discovery and fix
  • General mitigation strategies
  • Credit to vendor for cooperation (if appropriate)

Public Disclosure Should NOT Include:

  • Step-by-step exploitation instructions
  • Specific system details that could aid attackers
  • Information that could compromise ongoing security measures

Know Your Jurisdiction​

Security testing laws vary by location. Key legal frameworks include:

United States:

  • Computer Fraud and Abuse Act (CFAA)
  • State computer crime laws
  • Digital Millennium Copyright Act (DMCA)

European Union:

  • General Data Protection Regulation (GDPR)
  • Computer Misuse Acts (varies by country)
  • Cybersecurity legislation

Other Regions:

  • Research local cybersecurity and computer crime laws
  • Understand data protection requirements
  • Consider cross-border legal implications
  1. Get Written Permission: Always obtain explicit authorization
  2. Document Everything: Keep detailed records of your activities
  3. Consult Legal Counsel: When in doubt, seek legal advice
  4. Respect Boundaries: Stay within authorized scope
  5. Report Responsibly: Follow coordinated disclosure practices

🏢 Organizational Guidelines​

For Security Teams​

If you're using HackAgent within an organization:

Internal Testing:

  • Establish clear testing policies
  • Define authorized targets and boundaries
  • Create incident response procedures
  • Train staff on responsible practices

External Testing:

  • Develop vendor testing agreements
  • Create responsible disclosure policies
  • Establish communication protocols
  • Document testing procedures

For Bug Bounty Programs​

If you're participating in bug bounty programs:

Program Compliance:

  • Read and follow all program rules
  • Respect scope limitations
  • Use designated communication channels
  • Follow program-specific disclosure timelines

Quality Reporting:

  • Provide clear reproduction steps
  • Include impact assessment
  • Suggest remediation when possible
  • Follow up on vendor communications

🔬 Research Ethics​

Academic Research​

When using HackAgent for academic research:

Institutional Review:

  • Obtain IRB approval when required
  • Follow institutional research policies
  • Consider ethical implications of research
  • Plan for responsible data handling

Publication Guidelines:

  • Avoid detailed attack instructions
  • Focus on defensive measures
  • Coordinate with affected vendors
  • Consider dual-use research implications

Industry Research​

For commercial security research:

Client Agreements:

  • Clearly define testing scope
  • Establish communication protocols
  • Define deliverable expectations
  • Include liability and indemnification clauses

Professional Standards:

  • Follow industry ethical guidelines
  • Maintain professional certifications
  • Participate in security community standards
  • Contribute to defensive knowledge

🚨 Emergency Procedures​

If You Accidentally Access Sensitive Data​

  1. Stop immediately - Cease all testing activities
  2. Document minimally - Note what happened without detailing the data
  3. Delete data - Remove any downloaded or cached sensitive information
  4. Report immediately - Contact the system owner urgently
  5. Cooperate fully - Work with the organization to assess and mitigate risk

If You Discover Active Attacks​

  1. Assess urgency - Determine if immediate action is needed
  2. Contact immediately - Reach out to system owners urgently
  3. Provide assistance - Offer to help with incident response
  4. Document appropriately - Keep records for potential law enforcement
  5. Follow up - Ensure the issue is being addressed

If You Cause Unintended Harm​

  1. Stop testing - Immediately cease all activities
  2. Assess damage - Determine the scope of any harm caused
  3. Contact immediately - Notify affected parties urgently
  4. Offer assistance - Help remediate any damage caused
  5. Learn and improve - Adjust procedures to prevent recurrence

📚 Additional Resources​

Security Organizations​

Disclosure Platforms​

Remember: Security research is a responsibility, not just a technical exercise. By following these guidelines, you contribute to a more secure digital ecosystem while protecting yourself and others from harm.

For questions about responsible use of HackAgent, contact our security team at devs@vista-labs.ai.