Security

If you believe you have found a security problem in HarumAI, please tell us privately so we can fix it before anyone is harmed.

How to report

Email security@harum.ai with:

• what the problem is and where (the app version, page or address);
• the steps to reproduce it, and what an attacker could do with it;
• any proof of concept, screenshots or logs, with secrets removed;
• how you would like to be credited, if at all.

Please do not publish the details until we have released a fix or agreed a date with you. A person reads every report, and we will keep you informed while we work on it.

In scope

• The HarumAI desktop app, its installer, HarumAI Setup and its updates.
• HarumAI accounts and the online services the app uses.
• The websites harum.ai and download.harumai.com.

Problems in a model provider’s own service belong to that provider. Reports from automated scanners with no demonstrated impact, missing best practice headers on their own, and social engineering of our people are out of scope.

Testing in good faith

We will not take legal action against research done in good faith that follows every rule below. Research that breaks any of them is not covered.

• Test only against your own account and data, and only on the systems listed above.
• Do not access, copy, change or delete other people’s data. If you reach it by accident, stop, do not keep it, and tell us.
• Do not disrupt the service for others: no denial of service, load testing, spam or physical attacks.
• Use only as much access as you need to show the problem, and delete anything you obtained once you have reported it.
• Do not demand payment or anything else in return for a report or for keeping it private.
• Keep the details private until we have released a fix or agreed a date with you.
• Follow the law. This page cannot give you permission to test anyone else’s systems, including model providers and our hosting services, and it does not bind them or the authorities.

We may still act if research harms our users, the service or other people. We do not offer a paid bug bounty at this time.

Reporting misuse

If you see HarumAI being used for a crime, fraud or abuse, a published page that breaks our Terms of Service, a fake HarumAI download, or someone pretending to be HarumAI, write to security@harum.ai with the link or details. We review every report and act under our terms, including removing content, ending access and reporting to the authorities when the law requires it. In an emergency, contact the police first.

Checking your download

Each release is signed with HarumAI’s release key, and the app and HarumAI Setup check that signature before installing an update. The download page shows the SHA-256 of the current installer, taken from the signed release manifest when the page is built. To check a file you downloaded, run this in PowerShell in the folder where you saved it, and compare the result with the SHA-256 on the download section:

Get-FileHash .\HarumAI-installer.exe -Algorithm SHA256

Replace the file name with the name of the file you downloaded. Download HarumAI only from harum.ai or download.harumai.com.

Our security.txt lists the same contact for automated tools.