Skip to main content
Consus Industries welcomes responsible disclosure of security vulnerabilities in the Consus Gateway. If you’ve found something, we want to hear from you.

​
How to report

Email security@consusindustries.co with:
  • A description of the vulnerability
  • Steps to reproduce
  • Impact assessment (what an attacker could do)
  • Your contact information for follow-up
Do not include sensitive data (API keys, customer information) in your report. If you need to share sensitive details, request our PGP key.

​
Scope

In scope: the API endpoint (api.consus.io), public-facing documentation, and authentication and authorization mechanisms. Out of scope: vulnerabilities in upstream AI model providers (AWS Bedrock, GCP Vertex AI, Azure OpenAI), third-party libraries with an existing CVE, and social engineering.

​
What we commit to

We will keep you informed as we investigate and resolve the issue.

​
Safe harbor

We will not pursue legal action against researchers who act in good faith and follow this policy, avoid accessing or modifying other users’ data, do not disrupt service availability, and report findings promptly — allowing reasonable time for remediation before public disclosure.

​
Recognition

With your permission, we will credit you in our security advisories. We do not currently offer a paid bug bounty program.