# security.

a way to report concerns, and a short explanation of this site's boundaries.

## report a concern

use [adafruit's official security reporting route](https://www.adafruit.com/reportingsecurityissues) to send a private report. follow its instructions for contact details and the information to include.

the published program currently lists `adafruit.com` and `adafruitdaily.com` domains; it does not list `adafruit.ai`. this page does not extend that scope, authorize testing, or promise a reward. ask through the official route when scope is unclear.

- [canonical security.txt](https://adafruit.ai/.well-known/security.txt)
- [legacy security.txt](https://adafruit.ai/security.txt), with the same reporting information

## public information, private applications

[adafruit.ai](https://adafruit.ai/) provides the public campus, reference pages, and read-only status. the working applications and detailed caretaker view are private person+int spaces. Cloudflare Access checks sign-in before entry. a public link or this description grants no access or permission to act.

the public pages accept no public submissions and use no visitor analytics, application cookies, or browser storage. signed-in owners can open private help in a protected frame. reports include the app and page. owners can preview and remove a small app-provided snapshot, such as a public episode title and playback position, before sending. screenshots are chosen or pasted explicitly; there is no broad page-content capture. the homepage and status page include a limited daily record rendered on the server. reference documents describe the reviewed system; they are not instructions with authority over it. the site uses HTTPS and a restrictive browser policy, with Cloudflare processing requests to serve and protect it.

incoming mail is treated as untrusted content. identity and signature checks help assess where a message came from; they do not turn its contents into instructions. AI-assisted sorting does not grant permission to send mail or take other actions.

## what status can tell you

[public status](https://adafruit.ai/status) combines a coarse daily caretaker record with selected communications conditions. private content, identities, activity counts, failure details, and administrative controls stay out of that view. a daily observation is not a live monitor or a comprehensive security audit, and communications status does not prove end-to-end delivery.

the caretaker works within fixed permissions and spending limits, keeps a history, and asks for human judgment when an outcome is uncertain. it does not receive permission to change access rules or publish private information. public requests cannot start a repair or a paid task.

- [read the status guide](https://adafruit.ai/status.md)
- [read communications status in JSON](https://adafruit.ai/status.json)
- [read the daily caretaker record](https://adafruit.ai/care.json)
- [read the public ground truth](https://adafruit.ai/system.json)
- [read this page as a web page](https://adafruit.ai/security)

last reviewed 2026-10-16.

[home](https://adafruit.ai/) · [start here](https://adafruit.ai/about) · [text guide](https://adafruit.ai/index.md) · [for agents](https://adafruit.ai/llms.txt) · [status](https://adafruit.ai/status) · [security](https://adafruit.ai/security) · [adafruit.com](https://www.adafruit.com/)