Security and Vulnerability Disclosure

Reporting a vulnerability

Send reports to contact@geocentricai.com. Please include what you found, where, the steps to reproduce it, and your assessment of the impact. A proof of concept helps.

We aim to acknowledge a report within three business days and to keep you informed while we work on it. If you have not heard back, please chase us rather than assume the report was ignored.

Scope

In scope: geocentricai.com and its subdomains, the Geocentric Code repository and our other repositories under github.com/GeocentricAI, and the model files we publish, including problems in how a checkpoint or its loader handles untrusted data.

Out of scope: reports generated solely by automated scanners without demonstrated impact, missing security headers with no exploitable consequence, social engineering of our staff, physical attacks, and denial-of-service testing. Reports that a model produced incorrect, offensive, or unexpected text are model behaviour rather than security vulnerabilities — those are interesting to us, but send them to contact@geocentricai.com instead.

What we ask of researchers

• Do not access, modify, or retain other people's data. If you encounter someone else's data, stop and tell us.
• Do not run destructive tests, and do not degrade or disrupt the service for others.
• Keep the volume of automated testing low enough that it does not amount to a denial-of-service.
• Give us a reasonable opportunity to fix the issue before disclosing it publicly. We suggest 90 days, and we are happy to discuss a different timeline for a complex issue.
• Do not use a vulnerability to extract non-public material beyond what is needed to demonstrate the problem.

What we commit to

If you follow this policy in good faith, we will treat your research as authorised conduct. We will not initiate legal action against you, and we will not report you to law enforcement for that research. If a third party brings action against you for research conducted in accordance with this policy, we will make it known that your activity was authorised.

We will tell you what we found, what we fixed, and when. If you would like public credit, we will give it. We do not currently operate a paid bounty programme, and we will say so plainly rather than imply a reward that does not exist.

Our own practices

A short and deliberately non-specific summary: the website is served over HTTPS behind Cloudflare, with a restrictive Content Security Policy that limits scripts and styles to our own origin, sends no referrer, denies framing, and disables MIME sniffing. It stores no credentials, because it has none to store, and it holds no user conversations, because our models run on your device and never send them to us.

We do not publish details of our internal security controls or infrastructure, because doing so would weaken them without helping anyone acting in good faith.

Model files and a note on checkpoints

Some model checkpoints are distributed in formats, such as PyTorch .pt files, that can execute code when loaded. Only load a checkpoint you got from a source you trust, such as our official repositories, check it against the published checksum when one is given, and load untrusted files in a sandbox. We prefer safer formats where we can offer them. If you find a file on a Geocentric repository that does something it should not, tell us at once.

Reports that a model produces harmful or unsafe output are model-behaviour reports. Send them to contact@geocentricai.com with the prompt and response.