Last updated: 13 October 2026. This policy follows the Dutch NCSC guideline for Coordinated Vulnerability Disclosure (ncsc.nl/cvd-beleid). It is part of our security overview.
Scope
This policy covers the systems of HostYourAI B.V. that we operate ourselves:
hostyourai.comand its web application, the Router API (/v1) and the Management APIloes.ai,chat.loes.aiandbeta.loes.ai(Loes)- The
hyaicommand line tool and the open-source code we publish
Out of scope: the systems of our sub-processors and GPU providers (report those to the provider), customer-hosted environments we do not operate, and third-party software we only integrate. If you are unsure whether something is in scope, report it anyway and we will route it.
How to report
Send your report to info@hostyourai.com with the subject “Security report”. This is also published in our security.txt. Please include:
- The affected system or URL, and the type of vulnerability
- Steps to reproduce, or a proof of concept, so we can verify it quickly
- The impact you believe it has
- How we can reach you, and whether you want to be credited
If you want to encrypt your report, ask for our PGP key in a first message without details. Do not put secrets, personal data or exploit details in that first message.
What we ask of you
- Report the vulnerability to us first, and give us reasonable time to fix it before you share it with anyone else. We aim to fix within 90 days at the latest, and sooner for serious issues.
- Do not use the vulnerability further than needed to show that it exists. Do not copy, change or delete data, and do not look at other people’s data. If you do reach personal data, stop, do not keep it, and tell us.
- Do not run denial-of-service, spam, social-engineering or physical attacks, and do not disrupt other customers. Automated scanning is fine at low volume.
- Do not install backdoors, and do not use the access you gained to look for more vulnerabilities.
- Use only your own accounts and test data. Do not spend customer money or rent GPUs with someone else’s balance.
- Keep your report confidential until we have agreed on publication.
What you can expect from us
- We confirm receipt within 3 working days, and give an assessment within 10 working days.
- We keep you informed about progress and tell you when the issue is fixed.
- We treat your report confidentially and do not share your personal details with third parties without your permission, unless the law requires it.
- We will not take legal action against you, and will not ask the Public Prosecution Service to, for research done in good faith within this policy. If a third party starts proceedings against you for something you did in line with this policy, we will make clear that you acted within it.
- With your agreement we credit you by name or handle once the issue is fixed, and we are open to publishing a short write-up together.
- We resolve problems as quickly as we can and are happy to coordinate publication with you.
We do not run a paid bug bounty. As a thank-you we may offer a small token of appreciation for significant findings, at our discretion.
Not covered
These are usually not vulnerabilities, and we may close such reports without a response: missing security headers or cookie flags without a demonstrable attack, SPF/DKIM/DMARC suggestions, version banners, self-XSS, clickjacking on pages without sensitive actions, rate limiting on non-sensitive endpoints, results of automated scanners without a working exploit, and reports on software that is out of date without a concrete impact.
Personal data
Your report contains personal data (your contact details). We use it only to handle the report, under the legal basis of our legitimate interest in keeping our systems and our customers’ data safe, and keep it for as long as needed to follow up. See our privacy policy.
Questions about this policy
Write to info@hostyourai.com.