Security Policy

Last updated: November 10, 2026

Routeway takes the security of our platform and our users' data seriously. If you believe you have found a security vulnerability in Routeway, we want to hear about it. This policy explains what is in scope, how to report an issue, and what you can expect from us.

Reporting a Vulnerability

Email [email protected] with:

  • A description of the vulnerability and its potential impact
  • The affected URL, API endpoint, or component
  • Step-by-step instructions to reproduce it (a proof of concept, request/response samples, or a short video are very helpful)
  • Your Routeway account email if the issue involves your account
  • How you would like to be credited, if at all

Please write in English. Do not include other users' personal data, API keys, or prompts in your report beyond the minimum needed to show the issue.

Scope

In scope:

  • https://routeway.ai and its subpages, including the dashboard
  • https://api.routeway.ai (the Routeway API)
  • Authentication, sessions, account management, and API key handling
  • Billing, credits, subscriptions, and usage accounting
  • Isolation between accounts (one user accessing another user's data, keys, usage, or credits)

Out of scope:

  • Third-party AI model providers we route requests to, and their models' outputs. Report those to the provider directly.
  • Jailbreaks, prompt injection, or harmful output from upstream models, unless it lets you bypass a Routeway control (for example our request scanning, rate limits, or billing)
  • Third-party services we use (payment processors, email providers, hosting, CAPTCHA providers), unless the issue is caused by how Routeway configured or integrated them
  • Denial-of-service, load testing, or volumetric attacks
  • Social engineering, phishing, or physical attacks against Routeway staff or users
  • Reports from automated scanners without a demonstrated, exploitable impact
  • Missing security headers, cookie flags, or best-practice settings without a working exploit
  • SPF, DKIM, or DMARC configuration
  • Clickjacking on pages with no sensitive actions
  • Self-XSS, or attacks that require physical access to a victim's unlocked device
  • Rate-limit or brute-force reports on non-authentication endpoints
  • Software version disclosure or banner grabbing
  • Vulnerabilities in outdated browsers or platforms

Rules of Engagement

When researching vulnerabilities, you must:

  • Only test against accounts you own or have explicit permission to use
  • Stop and report as soon as you gain access to data that is not yours. Do not view, copy, modify, or delete it beyond the minimum needed to prove the issue
  • Not use, transfer, or resell credits, API keys, or model access obtained through a vulnerability
  • Not degrade the service for other users. Keep automated testing to a low request rate
  • Not use free tiers, trials, or referral programs at scale to generate usage
  • Not attempt to access our infrastructure, source code, or internal systems beyond what the vulnerability requires
  • Keep the details confidential until we have fixed the issue, or until 90 days after your report, whichever comes first, unless we agree otherwise in writing

If remediation requires additional time, we will communicate with you and work toward a mutually agreed disclosure timeline. We encourage coordinated disclosure and ask researchers to avoid publishing sensitive exploit details that could put users at risk.

Safe Harbor

If you make a good-faith effort to follow this policy, we will:

  • Consider your research authorized and not pursue or support legal action against you for it
  • Not treat it as a breach of the restrictions in our Terms of Service (such as the ban on reverse engineering) to the extent the research is needed to find and demonstrate the vulnerability
  • Not suspend or close your account because of the research
  • Work with you to understand and fix the issue quickly

We will not initiate legal action against researchers for accidental, good-faith violations of this policy when they promptly stop testing, report the issue, and take reasonable steps to minimize harm.

This safe harbor does not cover deliberate actions that break the rules above, cause harm to Routeway or our users, or violate applicable law. If you are unsure whether something is allowed, ask us at [email protected] before you test.

What to Expect From Us

Security reports are our highest priority. You can expect:

  • Acknowledgement within 24 hours of your report
  • Initial assessment within 48 hours, including whether we can reproduce it and how severe we consider it
  • Status updates whenever there is progress, and at least every 3 days until the issue is resolved
  • Notification when the issue is fixed, and public credit if you want it

We prioritize critical and high-severity vulnerabilities and aim to implement an initial mitigation within 72 hours of confirming the issue. We aim to resolve all other valid issues within 30 days. Resolution timelines may vary depending on complexity and third-party dependencies.

Rewards

Routeway does not currently run a paid bug bounty program. At our discretion, we may offer account credits or other thanks for valid, high-impact reports that follow this policy. Asking for payment in exchange for not disclosing a vulnerability is not a good-faith report and is not covered by this policy.