Policies · Beta-2 draft
Security Policy
Last updated: 10 November 2026
This is a beta-2 policy draft for review before launch. It is not legal advice. If anything is unclear, contact support@awaitarcade.com.
Supported versions
Security fixes target the current beta build (the latest development head and
the beta-1 tag) of the API, website, and official host builds. Older
builds are not supported.
Reporting a vulnerability
Email security@awaitarcade.com with:
- a description and impact;
- steps to reproduce, including URLs and accounts;
- any proof-of-concept or logs, with secrets redacted;
- your preferred contact and whether you want credit.
Do not open a public issue for a vulnerability. Do not access, modify, or delete other people’s data, and do not disrupt the service.
What to expect
- We aim to acknowledge reports within 2 business days.
- We aim to triage within 7 days and fix confirmed issues as soon as practical.
- We will coordinate disclosure after a fix; please give us reasonable time.
Safe harbor
We will not pursue legal action for good-faith research that follows this policy, avoids privacy violations and service disruption, and is reported privately. This is not a bug bounty and does not authorize testing third-party services.
Scope
In scope: awaitarcade.com, the Await Arcade API, the official OpenCode
and Antigravity clients, and the public source repository. Out of scope: GitHub,
Google Cloud, Zoho, denial-of-service testing, spam, social engineering, and physical
attacks.