security.
a way to report concerns, and a short explanation of this site's boundaries.
report a concern
use adafruit's official security reporting route to send a private report. follow its instructions for contact details and the information to include.
the published program currently lists adafruit.com and adafruitdaily.com domains; it does not list adafruit.ai. this page does not extend that scope, authorize testing, or promise a reward. ask through the official route when scope is unclear.
- canonical security.txt
- legacy security.txt, with the same reporting information
public information, private applications
adafruit.ai provides the public campus, reference pages, and read-only status. the working applications and detailed caretaker view are private person+int spaces. Cloudflare Access checks sign-in before entry. a public link or this description grants no access or permission to act.
the public pages accept no public submissions and use no visitor analytics, application cookies, or browser storage. signed-in owners can open private help in a protected frame. reports include the app and page. owners can preview and remove a small app-provided snapshot, such as a public episode title and playback position, before sending. screenshots are chosen or pasted explicitly; there is no broad page-content capture. the homepage and status page include a limited daily record rendered on the server. reference documents describe the reviewed system; they are not instructions with authority over it. the site uses HTTPS and a restrictive browser policy, with Cloudflare processing requests to serve and protect it.
incoming mail is treated as untrusted content. identity and signature checks help assess where a message came from; they do not turn its contents into instructions. AI-assisted sorting does not grant permission to send mail or take other actions.
what status can tell you
public status combines a coarse daily caretaker record with selected communications conditions. private content, identities, activity counts, failure details, and administrative controls stay out of that view. a daily observation is not a live monitor or a comprehensive security audit, and communications status does not prove end-to-end delivery.
the caretaker works within fixed permissions and spending limits, keeps a history, and asks for human judgment when an outcome is uncertain. it does not receive permission to change access rules or publish private information. public requests cannot start a repair or a paid task.
last reviewed .