Reporting a security issue
If you've found a vulnerability in Genmodic, please tell us privately so we can fix it before anyone is harmed.
How to report
Email security@genmodic.com set up this address, or use hello@genmodic.com with a description, the steps to reproduce it, and what an attacker could do. We'll confirm we received it within 3 business days, keep you updated, and credit you when it's fixed if you'd like. We don't currently pay bounties.
In scope
genmodic.com and its sign-in, account, billing, online storage, worlds, sharing, world store, model marketplace, Director and support-assistant services.
Please
- Use only your own accounts, or test accounts you made. Don't access, change or delete other people's data; if you reach some by accident, stop and tell us.
- Don't run denial-of-service, spam or social-engineering tests, or attack Stripe, Cloudflare, Anthropic or other providers' own systems.
- Don't run up AI costs or make real purchases or payouts beyond what's needed to show the issue.
- Don't try to make the support assistant act on someone else's account or give refunds you aren't owed, beyond what's needed to show the issue.
- Give us a reasonable time (90 days) to fix it before talking about it publicly.
Safe harbour
If you follow this policy in good faith, we consider your research authorised, won't take legal action against you for it, and will say so if someone else does.
Machine-readable contact: /.well-known/security.txt.