Vulnerability disclosure policy.

Last updated October 30, 2026

Our commitment

Wake exists to keep records that agents can’t rewrite, and controls they can’t switch off, so a security flaw in it matters more than most. If you find one, we want to hear about it, and we’ll work with you to fix it and to disclose it responsibly. We don’t run a bug bounty and can’t pay for reports, but we’ll gladly credit you.

Scope

This policy covers:

• Wake’s open source recorder, in the usewake/wake repository on GitHub: the SDKs and their memory adapter, the proxy, the collector, the signed log and wake-log, the deploy files and the reference fleet.
• This website, getwake.co.

We especially want to hear about:

• changing, removing or forging events in the signed log without wake-log verify noticing;
• credentials or other secrets that survive redaction into the log;
• getting a call past the proxy’s identity check, or past a halt it should deny; and
• any way for code running inside an agent to reach a signing key.

It doesn’t cover:

• Wake Platform, which isn’t publicly available yet;
• flaws in other companies’ services, or in open source projects Wake depends on. Report those to their maintainers, and tell us too if Wake is affected;
• denial of service, spam, social engineering, phishing or physical attacks;
• reports from automated scanners that don’t show a real impact; or
• missing security headers or similar settings on this website, unless you can show a working attack.

How to report

Email security@getwake.co. Please include:

• what’s affected: the component, and its version or commit;
• how to reproduce the problem, ideally with a proof of concept;
• what an attacker could do with it; and
• how you’d like to be credited, if at all.

If your report includes something sensitive, say so in your first email, and we’ll agree on a safer way to send it. Please don’t include anyone else’s personal information.

What to expect from us

• We’ll confirm we’ve received your report within three business days.
• Within ten business days, we’ll tell you whether we can reproduce the problem and how serious we think it is, and we’ll keep you updated while we fix it.
• We aim to fix confirmed problems and publish an advisory within 90 days of your report, sooner for the most serious ones, and we’ll agree the timing of any public disclosure with you.
• If you’d like, we’ll credit you in the advisory.

Safe harbor

If you make a good-faith effort to follow this policy, we’ll consider your research authorized. We won’t take legal action against you or report you to law enforcement over it, and if anyone else does, we’ll make it known that you acted with our authorization. This covers Wake’s own code and systems only: we can’t authorize testing of anything that belongs to someone else.

Guidelines

To stay within this policy:

• test against your own installation of the recorder, and accounts and data that are yours;
• don’t access, change, delete or keep data that isn’t yours. If you come across some, stop and tell us;
• don’t degrade the website, or anyone’s use of it;
• give us reasonable time to fix a problem before you disclose it publicly; and
• don’t ask for payment or other rewards in exchange for not disclosing what you found.