TOSWO
Disclosure policy
How we handle reports, protect reporters and publish findings about AI systems.
This is how we treat information people give us and how we publish what we find.
Reporters
- We never publish a reporter's identity or contact details, and the anonymous option stores no contact at all.
- We keep only a salted one-way hash of the sender's network address, to limit abuse and judge how reliable a source has been. The address itself is not stored. See the privacy page.
- Reports are read by a researcher before they can contribute to a confirmed event.
Findings about AI systems
- Events are confirmed only after review of the evidence. Automatic detections are labeled as such.
- Before publishing details that could help someone misuse a system (a working prompt, an exploit, a method to defeat a safeguard), we notify the provider and give them reasonable time to respond. We publish the finding and what it shows, and leave out the recipe.
- Where a provider disagrees, we publish their response next to our finding, in full if they ask.
- Reports in the public record come from published sources and are marked with who said it and how sure we are.
Corrections
If we get something wrong we fix it, say so and list it on the corrections page. Fixes are not silent.