Security

1. How to report a vulnerability

Email support@adako.ai with the subject “Security”. It is the one inbox Adako has, and a person reads it. Please report privately first and do not publish the details until the issue is fixed.

The same address is in /.well-known/security.txt, in the format RFC 9116 describes.

2. What to include

• Where the problem is: the page, the API endpoint, the MCP tool or the CLI command, with the URL or tool name.
• The steps to reproduce it, and the requests and responses if you have them.
• What an attacker could do with it, and whose data or accounts it would reach.
• How to reach you if the reply should go somewhere other than the sending address.

3. What happens next

We reply within 7 days to confirm we received the report, and say whether we could reproduce it. While we work on a fix we keep you informed, and we tell you when it is live.

If you plan to publish your findings, tell us when. We ask for enough time to fix the issue first, and we agree a date with you.

4. Testing in good faith

If you follow the rules below, we treat your research as authorised under the Terms of Service, we do not take legal action against you, and we do not ask anyone else to.

• Use only your own Adako account and ad accounts you control. Do not change, read or keep another user’s data. If you reach it by accident, stop, report it and delete what you saw.
• Do not degrade the Service: no denial of service, no load testing, no scanning at a volume that affects other users.
• No social engineering or phishing of anyone, and no physical attempts.
• Do not flood the contact form, the support inbox or the emails Adako sends. One report per issue is enough.
• Do not use a vulnerability beyond what you need to show that it exists.

5. What is in scope

adako.ai: the website, the web app, sign-in, the MCP server at /mcp, the REST API under /api/v1, and the adako command-line tool.

The ad platforms themselves (Google Ads, Meta, LinkedIn, ChatGPT Ads) are not ours to test. Report issues in them to the platform. The same goes for the services Adako runs on.

6. No bug bounty

Adako is run by one person and does not pay for reports. We still read every one and fix what is real.