AgentMart

Report a security problem

Found a security problem in AgentMart? Please tell us. This page says how, what we ask of you while you look, and what we promise in return.

AgentMart is run by Ciphyr Tech OÜ, a small company in Estonia (who we are: /trust).

01How to report

  • Email mustafaakmese@ciphyr.ai. Write in English.
  • Tell us where the problem is (the address or the tool), what you did, what happened, and what an attacker could do with it. Steps we can repeat help most.
  • Tell us the ids of the passports and top-ups you used for your tests.
  • Never put a password, a card number, an API key, a token or anyone else's personal data in your email. We never ask for them. We have no encryption key for email.
  • For security tools: /.well-known/security.txt.

02What this page covers

  • Our site agentmart.ciphyr.ai: the website, the API (/v1), our MCP servers (/mcp and the addresses under it), the sign-in pages and addresses (/oauth and /.well-known) and the files for AI agents, such as /llms.txt. Also the plugins we publish for AI apps.
  • Also covered: how we set up the services of other companies for AgentMart, for example how our site sends you to Stripe's payment page.
  • Not covered: the systems of those companies themselves, such as Stripe's payment page (checkout.stripe.com) or our host Vercel. The full list is in our privacy notice. Report a problem there to that company. We cannot allow tests on their systems.
  • Not covered either: our company's other websites and products, such as ciphyr.ai itself and De.Ciphyr, and other websites our tools check or link to.

03What we ask of you

  • Use only your own account, your own agents and your own test data. Use only email addresses that are yours, so we never email someone who did not ask.
  • Do not look at, copy, change or delete anyone else's data. If you reach it by accident, stop, keep nothing, and tell us right away.
  • Spend no money that is not yours: no payments with a card that is not yours, and no refunds, credits or purchases you are not owed. If you find a way to get something for free, show it once, with the smallest amount, and tell us.
  • Never open a dispute with your bank about a payment you made for a test: a dispute about your own payment blocks your account. Ask us instead.
  • Do not slow down or stop the site for others: no load tests, no floods, nothing that fills our storage or sends masses of email. An answer 429 (too many requests) is the limit working, not a problem.
  • Do not put malware or unlawful content in share links, lockers, inboxes or anything else we store or show.
  • Do not trick people: no phishing, no calls, no fake messages to us, our customers or the companies we work with. No tests on offices or devices.
  • When you test whether our tools can be made to reach other systems, point them only at systems you own. If a tool of ours reaches a private address, one request that shows it is enough: read nothing more.
  • Give us time to fix the problem before you tell others, and tell us before you publish.
  • Never ask for money in exchange for keeping a problem quiet.

04What we promise

  • We read every report. We answer by email the reports about what this page covers that show a real problem, not scanner output alone.
  • For those, we tell you what we decide. If we fix it, we tell you when it is fixed.
  • If you follow this page in good faith, we treat your research as allowed. We will not take legal action against you, and we will not ask the authorities to act against you, for that research. If someone else takes legal action against you for it, we will say that we allowed it.
  • For research that follows this page, this page comes before section 13 of our terms. Apart from that, our terms and our privacy notice stay as they are.
  • If you break a rule by accident, stop and tell us right away. We still count that as good faith.
  • Our automatic protections may still block a test account. Tell us and we look at it. A block is not legal action.
  • We may still have to report a data breach to the data protection authority and tell the people affected, as the law requires. That is not a complaint against you.
  • This promise comes from Ciphyr Tech OÜ only. It cannot cover other companies, such as Stripe.

05What we do not promise

  • No money: we have no bug bounty and pay no rewards. A report never makes us owe you anything.
  • No reply time and no fix date. We are a small company.
  • We may not answer reports about things this page does not cover, or scanner output with no example of a real attack.
  • Usually not a problem for us, unless you show a real attack with it: a missing security header, the DNS records of our email, a page of ours inside a frame when it has no button or form to trick anyone with, a script that runs only when you paste it into your own browser (self-XSS), and our limits answering 429.

06Your report and your email

  • Ciphyr Tech OÜ (who we are: /trust) keeps your email address, your report and our replies, to look into the problem and fix it. Our legal basis is our legitimate interest in keeping AgentMart and its users safe (Article 6(1)(f) GDPR).
  • Who else receives them: Google runs our mailbox (Google Workspace) for us, through its Irish company Google Cloud EMEA Limited, and Google LLC, United States, under Google's data processing terms (its Cloud Data Processing Addendum), which are part of our Google Workspace agreement. Google can process them in the United States and in other countries where it has data centres. For transfers out of the EU those terms use the EU-US Data Privacy Framework, in which Google takes part, or else the EU Standard Contractual Clauses.
  • Anthropic receives them when we use its AI assistant Claude to help look into a report. We use Claude on a plan for individuals, so Anthropic handles what we give it under its own terms and privacy policy and decides itself how it uses and keeps it: our time limit below does not bind that copy. Anthropic's privacy policy names its Irish company, Anthropic Ireland, Limited, as the company responsible in Europe, and says what we give it goes to its servers in the United States, with the EU Standard Contractual Clauses or an adequacy decision of the European Commission as the safeguard.
  • The authorities receive them only where the law requires it.
  • We keep our copy for 2 years after we close the report, and longer only while we need it for a legal claim.
  • You may ask us to see, correct or delete them, to limit how we use them, or object to this use, at the same address. You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee. Everything else we do with personal data is in our privacy notice.
  • Unsure whether a test is allowed? Ask us first at the same address.
  • Version of 24 October 2026.