deepset
Responsible Security Disclosure
Responsible Security Disclosure
Security is a top priority at deepset, across our platform, our open-source projects, and the data our users trust us with. If you believe you have discovered a security vulnerability in any of our systems, we want to hear from you.
We value the work of security researchers who help us maintain a strong security posture, and we are committed to working with you to understand and resolve issues quickly and responsibly.
Our Commitment
If you follow the guidelines outlined below when reporting a vulnerability, we commit to:
- Working with you in good faith. We will not take adverse action against researchers who follow this policy.
- Acknowledging receipt of your report within 5 business days.
- Keeping you informed of our progress as we work toward resolution.
Responsible Disclosure Guidelines
We ask that you:
- Report vulnerabilities to us before disclosing them publicly or to any third party.
- Allow us a reasonable period (90 days) to investigate and remediate the issue before any public disclosure.
- Do not access, modify, or delete data belonging to other users or accounts you do not own.
- Do not degrade or disrupt our services or infrastructure.
- Do not exploit a vulnerability beyond what is necessary to confirm it exists.
- Act in good faith and comply with all applicable laws.
Scope
In scope:
- deepset.ai and all subdomains
- Haystack Enterprise Platform
- Haystack open-source framework (for Haystack specifically, please also refer to our SECURITY.md and reporting address)
Out of scope targets:
- Third-party services or integrations hosted by other providers
- Non-production environments, unless the finding demonstrates exploitable lateral movement from a non-production environment into production infrastructure
- Vulnerabilities in upstream open-source dependencies not maintained by deepset (please report these to the relevant maintainer)
Out of scope issue types:
The following categories will not be investigated under this policy:
- Reports that our services do not fully align with best practices (e.g., missing security headers such as CSP or X-Frame-Options, SPF/DMARC configuration suggestions)
- TLS configuration weaknesses (e.g., support for older cipher suites, TLS 1.0, SWEET32)
- Social engineering or phishing attacks targeting deepset employees or contractors
- Denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks
- Brute-force attacks against authentication or login systems
- Attacks against deepset's physical infrastructure
- Clickjacking on pages with no sensitive actions
- Self-XSS that cannot be used to exploit other users
- Missing cookie flags on non-sensitive cookies
- Information disclosure that does not present a meaningful security risk (e.g., server version headers, stack traces on non-production environments)
- Exposed public source maps (e.g., .map files that reveal readable JS source but do not expose secrets, credentials, or internal API logic)
- Content spoofing or text injection without a demonstrable security impact
- Reports generated by automated scanning tools (e.g., Nuclei, Burp Suite, Nessus, etc.) or AI without manual validation of an actual exploitable vulnerability
Reporting a Vulnerability
To report a security vulnerability, email us at: security-disclosure@deepset.ai.
To help us triage efficiently, please include:
- A clear description of the vulnerability and the affected asset.
- Step-by-step instructions or a proof-of-concept to reproduce the issue.
- An explanation of the potential security impact.
- Any evidence of active exploitation, if known.
- Supporting materials such as screenshots, scripts, or network traces.
Reports that fall outside the scope defined above, or that relate to out-of-scope issue types, may be dismissed without response.
Recognition
While we do not operate a formal bug bounty program at this point in time, we do appreciate the time and skill that goes into responsible security research, and we are happy to work with researchers who report valid findings in good faith.
Duplicate Reports
If a vulnerability has already been reported by another researcher or is already known to us internally, we will let you know. We appreciate the effort involved; however, duplicate reports do not qualify for any discretionary recognition or reward.
Changes
We may update this policy from time to time. The most current version will always be available at this page.
