01Reporting a vulnerability
Email security@anyray.ai with a description of the issue, the affected component, and steps to reproduce. We acknowledge new reports within 2 business days and aim to complete initial triage — confirming validity and severity — within 5 business days. Please give us a reasonable window to investigate and remediate before any public disclosure.
A PGP key for encrypted reports is to be confirmed with the team.
02Scope
In scope:
- the Anyray website (anyray.ai);
- the Anyray gateway, optimizer, and console container images;
- the Anyray Portal control plane.
Out of scope: the configuration and infrastructure of a customer's own self-hosted deployment (that environment is the customer's to secure), and the upstream LLM provider APIs Anyray forwards to.
03Good-faith research
We will not pursue legal action or report you to law enforcement for security research conducted under this policy, provided you: report the issue privately and give us a reasonable opportunity to investigate and fix it before any public disclosure; avoid privacy violations, data destruction, and service disruption; and only access, modify, or test against accounts and data you own or have explicit permission to use. We consider such research authorized under the Computer Fraud and Abuse Act and equivalent state and international laws, and will not bring a claim against you for circumventing technical controls solely to demonstrate or validate a vulnerability covered by this policy.
04Software supply chain & update integrity
Because Anyray runs in your environment, the integrity of the images you install matters as much as any runtime control. On Docker / Compose installs, the optional one-click update path is locked down:
- Least-privilege socket. The updater never sees the raw Docker socket — it reaches the daemon only through a socket proxy exposing just the calls needed to pull and recreate containers, and the socket is mounted read-only.
- In-network only. Neither the socket proxy nor the updater publishes a host port — they're reachable only on the internal network.
- Admin-gated & opt-in. The update trigger is gated by your admin session; the updater token is injected server-side and never reaches the browser. Unattended auto-update stays opt-in.
- Scoped to Anyray images. The updater only acts on the Anyray app containers — never your datastores or anything else on the host. It moves images, not data: no prompt or response content is involved.
- No inbound access. Updates are pulled by your deployment; Anyray has no inbound access to your environment.
The full mechanics are documented at docs.anyray.ai/operate/security.
05Contact
Email: security@anyray.ai · also published at /.well-known/security.txt