Reporting a security problem

Mail support@morphscreen.com with "Security" in the subject. Please don't post it anywhere public first.

Tell us what you found, how to reproduce it (the request, the answer text, the page or app it showed in) and what someone could do with it. A short proof of concept helps more than a scanner report.

We reply within 3 working days (Monday to Friday, India time) to say we've got it, then keep you posted until it's fixed. Tell us if you'd like to be credited when the fix ships.

What's covered

• The API (api.morphscreen.com), the dashboard (app.morphscreen.com) and this website.
• The core and the SDKs we publish.

What counts most: anything that runs a model's text as code, loads from a host the app didn't allow, leaks a key, or reads someone else's account, answers or usage.

Please don't load-test our servers, read or change other people's data, or try phishing or social engineering. Bugs in OpenRouter, a photo provider or a map provider go to them.