Responsible Disclosure & Ethics Policy

1. Our Principles

KnowYourAI conducts AI security assessments and adversarial testing with a commitment to ethical practices, responsible disclosure, and the advancement of AI safety. Our work is guided by the following principles:

• Authorization first: We only test systems with explicit written authorization from the system owner or authorized representative
• Proportionality: Our testing methods are proportionate to the engagement scope and designed to minimize unintended impact
• Transparency: We clearly communicate our methodologies, findings, and limitations to clients
• Human oversight: Final risk decisions and remediation priorities remain with responsible human stakeholders, not automated scoring alone
• Harm reduction: We prioritize scenarios with real-world impact potential, focusing on safety-critical and abuse-prone behaviors
• Privacy respect: We handle all data encountered during assessments with strict confidentiality and in accordance with our Privacy Policy

2. Responsible Disclosure

When our research identifies vulnerabilities in third-party products or services, we follow responsible disclosure practices:

• We notify the affected vendor or organization before any public disclosure
• We provide reasonable time for the vendor to investigate and remediate before public disclosure
• We do not exploit discovered vulnerabilities beyond what is necessary to demonstrate the issue
• We work with vendors and bug bounty programs where available
• Public disclosures focus on advancing security knowledge and are presented with appropriate context

3. Client Engagement Ethics

In client engagements, we adhere to the following standards:

• We operate strictly within the authorized scope defined in the engagement agreement
• We do not access, exfiltrate, or retain data beyond what is necessary for the assessment
• We report all findings to the client, including findings that may be inconvenient or unfavorable
• We do not misrepresent our findings or inflate severity to drive additional business
• We maintain strict confidentiality of all client data, systems, and findings

4. Research Ethics

Our published research and case studies:

• Are based on authorized testing or publicly accessible systems
• Do not disclose information that could enable exploitation of unpatched vulnerabilities
• Are reviewed for accuracy and responsible framing before publication
• Credit relevant prior work and acknowledge limitations

5. Limitations

We acknowledge that:

• No security assessment can identify all possible vulnerabilities
• The absence of findings does not guarantee the security of a system
• AI systems evolve continuously, and findings are a point-in-time snapshot
• Our recommendations are advisory and do not constitute legal, regulatory, or compliance certification

6. Reporting Concerns

If you believe that KnowYourAI or any individual acting on behalf of KnowYourAI has engaged in conduct inconsistent with these principles, please contact us through the information provided on our website.