SECURITY
Report a security issue
If you find a problem with familyofficeknowledgegraph.ai — a key that does not verify, a door that answers wrong, a record whose source URL does not say what the field says, a receipt that will not resolve, a header that lies — tell the office.
- Machine-readable contact and policy: /.well-known/security.txt
- Scope: familyofficeknowledgegraph.ai and its twins (.com, .org, .io), the mcp, agent and node hosts, the machine kit, the records, /api and /x402.
- Out of scope: the registers the records cite, the office's own surface at agent-kg.ai (which has its own security page), and any third-party rail (Cloudflare, Coinbase, Formspree).
- What to send: the URL, the request you made, what came back, and what you expected. Signed reports are welcome; the office keyring is at /.well-known/jwks.json if you want to encrypt to it.
- What the office does: acknowledges within five business days, fixes on the office's own clock, and credits you on this page if you want credit.
No bounty. Good-faith research within scope will not be met with legal action.