Sequential

Sequential Vulnerability Disclosure Policy

Last changed: 25 October 2026.

If you find a security problem in Sequential, please tell us. This page tells you how to report it, what you may test, and what we do with your report.

1. How to report

Write to security@usesequential.com. Tell us:

  • what the problem is, and where (the address, the API call or the SDK version);
  • the steps to show the problem;
  • what an attacker could do with it;
  • how we can contact you.

Write in English or Czech. Do not put personal data of other people in the report. If you must show data to prove the problem, show only the smallest part.

We do not pay rewards for reports. With your permission, we thank you by name when the problem is fixed.

2. What is in scope

  • www.usesequential.com: the website and the app;
  • app.usesequential.com: a new version of the app;
  • api.usesequential.com: our API, including the agent connection (MCP) and its sign-in;
  • cdn.usesequential.com and the script sequential.js;
  • our SDK packages, for example @usesequential/node.

3. What is not in scope

  • the websites and apps of our customers. Report a problem there to that customer;
  • the services of our providers, for example AWS or Vercel. Report a problem there to that provider;
  • attacks that stop the service or slow it down (denial of service), and load tests;
  • social engineering, phishing and physical attacks on our people or places;
  • reports from automatic scanners without a working example of the problem;
  • missing security headers, missing email records (SPF, DMARC) and other settings, unless you show how someone can use them to cause harm.

4. Rules for your research

  • Use only accounts and projects that you made yourself.
  • Do not read, change or delete data that is not yours. If you get access to data that is not yours, stop, do not keep a copy, and tell us at once.
  • Do not use a problem more than you need to show it.
  • Do not do anything that can stop or slow the service for other people.
  • Do not tell anyone else about the problem until we have fixed it, or until 90 days after your report. We can agree a different time with you.

5. What we do

  • We confirm that we received your report within 3 working days.
  • We tell you what we think of the problem within 10 working days.
  • We fix a problem by its severity: a critical problem within 7 days, a high one within 30 days, a medium one within 90 days.
  • We tell you when the problem is fixed.

6. Safe harbour

If you follow this policy in good faith, we consider your research authorised. We do not take legal action against you, and we do not report you to the police, for that research. If a third party takes legal action against you for research that follows this policy, we tell them that we authorised it.

This policy cannot authorise research on systems that are not ours (section 3).

7. Contact

Sequential is run from the Czech Republic. Security reports: security@usesequential.com. Everything else: hello@usesequential.com. See also our Privacy Policy and our Terms of Service.