Gazebo
    ServicesAgentsDocsSpecWritingPricing
    Log inSign up
    Log in

    Getting Started

    • Introduction
    • How Gazebo works
    • Core concepts
    • Quickstart

    Agent Access

    • Access profiles
    • Bearer tokens
    • Audit logs

    MCP

    • Overview
    • Cursor
    • Claude Code
    • Windsurf
    • Any MCP client
    • get_credential reference

    Open Standard

    • AIP Specification ↗

    Sharing Agents

    • Overview
    • Publishing an agent
    • The consent screen
    • Installing a shared agent
    • The identity stamp

    REST API

    • Authentication
    • Verification endpoint

    Security

    • Overview
    • Encryption model
    • Credential storage
    • Audit and compliance
    • Responsible disclosure
    Documentation

    Getting Started

    • Introduction
    • How Gazebo works
    • Core concepts
    • Quickstart

    Agent Access

    • Access profiles
    • Bearer tokens
    • Audit logs

    MCP

    • Overview
    • Cursor
    • Claude Code
    • Windsurf
    • Any MCP client
    • get_credential reference

    Open Standard

    • AIP Specification ↗

    Sharing Agents

    • Overview
    • Publishing an agent
    • The consent screen
    • Installing a shared agent
    • The identity stamp

    REST API

    • Authentication
    • Verification endpoint

    Security

    • Overview
    • Encryption model
    • Credential storage
    • Audit and compliance
    • Responsible disclosure
    DocsSecurityResponsible disclosure

    If you discover a security vulnerability in Gazebo, please report it responsibly. We take all reports seriously and will respond promptly.

    How to report

    Email: security@gazebohq.com

    Please include:

    • A description of the vulnerability
    • Steps to reproduce
    • The potential impact (what an attacker could do)
    • Any proof-of-concept code or screenshots (if applicable)

    We ask that you do not publicly disclose the vulnerability until we've had a chance to investigate and release a fix.

    What to expect

    • Acknowledgement within 24 hours of your report
    • Initial assessment within 72 hours — we'll confirm whether the report is valid and its severity
    • Fix timeline communicated once the severity is assessed — critical issues are addressed immediately; lower severity issues are scheduled in the next release cycle
    • Credit — we'll acknowledge your contribution in the fix notes if you'd like

    Scope

    In scope:

    • Authentication and authorization bypasses
    • Credential leakage — any path that returns a plaintext credential to an unauthorized party
    • Privilege escalation — accessing another user's vault, agents, or audit logs
    • MCP or REST API vulnerabilities
    • Injection vulnerabilities in any user-controlled input

    Out of scope:

    • Rate limiting or denial of service
    • Theoretical vulnerabilities without demonstrated impact
    • Issues requiring physical access to infrastructure
    • Social engineering attacks

    Bug bounty

    We do not currently operate a formal bug bounty program, but we recognize significant contributions with acknowledgement and Gazebo credits.

    Explore Gazebo

    Gazebo gives each agent an independent access boundary around your agent credentials, with controls for approval, auditing, and revocation.

    Scoped identities for AI agentsGive every agent only the credentials it needs.Credential security and audit controlsSee how access is protected, recorded, and revoked.
    Audit and compliance
    Gazebo

    IAM for AI agents. Scoped credentials, access policies, and audit trails — without rotating keys.

    Product

    • Pricing
    • Status

    Explore

    • Services
    • Agents
    • Workflows
    • Integrations

    Content

    • Writing
    • Topics
    • Blog
    • Docs

    Free Tools

    • Scanner

    Company

    • About
    • hello@gazebohq.com
    • security@gazebohq.com

    © 2026 Gazebo. All rights reserved.

    PrivacyTermsSecurity