Security policy

If you find a security problem with this site or with mail from theclauditor.ai, please tell us.

How to report

Write to hello@theclauditor.ai. If you prefer to encrypt, our PGP key is at /.well-known/pgp-key.txt. The same details are published in machine-readable form at /.well-known/security.txt.

What you can expect

An acknowledgment within three business days. A plain-English reply about what we found and what we fixed. Credit here, if you want it, once the problem is fixed.

What we ask

Give us reasonable time to fix a problem before you publish it. Do not read, change or keep data that is not yours. No denial-of-service tests, no social engineering of people who work with us, no physical attempts.

Safe harbor

If you follow this page in good faith, we consider your research authorized and will not pursue legal action over it. If a third party does, we will say so on your behalf.

Scope

In scope: theclauditor.ai, www.theclauditor.ai, mta-sts.theclauditor.ai, and mail sent from theclauditor.ai. Out of scope: Cloudflare's and Google's own systems, which host the site and the mail — report those to them.

Last updated 2026-10-26.