# Security

Last updated: 2026-10-14

Gecko moves money for agents. If you find a way to make it move money it should not, or show data it should not, tell us. This page says how, what we promise back, and what Gecko does today to protect money and data.

HTML version: https://geckovision.tech/security
security.txt: https://geckovision.tech/.well-known/security.txt

## Report a vulnerability

Email security@geckovision.tech. Please do not open a public GitHub issue for a vulnerability.

Security lead: Ernani Britto, co-founder. Reports to security@geckovision.tech reach him directly.

### What to include

- Steps to reproduce, as exact as you can make them.
- The impact: what an attacker gains, and from whom.
- The affected URL or MCP tool, or the file and commit in the open-source engine.
- Whether you want credit, and under what name.

Want to send it encrypted? Ask us for a key in a short first email. We do not publish a PGP key yet.

## What we commit to

- We acknowledge your report within 3 business days.
- We send a status update within 10 business days.
- We set the fix timeline by severity, and we tell you what it is.
- We credit you after the fix, unless you prefer to stay anonymous.

There is no paid bug bounty yet. We say so now so nobody is surprised later.

## Scope

### In scope

- mcp.geckovision.tech: the hosted MCP surfaces, the OAuth endpoints, /anyquery, /paysh and the /d/ dataset endpoints.
- app.geckovision.tech.
- geckovision.tech.
- The open-source gecko-surf engine at github.com/GeckoVision/gecko-surf.

### Out of scope

- Third-party providers that Gecko routes calls to. Report those to the provider. We will help coordinate if you ask.
- Volumetric denial of service.
- Findings that need an already compromised device.
- Missing best-practice headers with no shown impact.
- Social engineering.

## Good-faith research

If you research in good faith and follow these rules, we treat your research as authorised. We will not take legal action against you for it.

- Test with your own account and your own keys.
- Do not move real funds that are not yours.
- Do not access or keep other customers' data. If you reach some, stop, and tell us what you saw.
- No denial of service and no load testing.
- No social engineering or phishing of our team or our users.
- No physical attacks.
- Give us reasonable time to fix before you disclose in public. We agree the date with you.

## How Gecko protects money and data

What the product does today. Nothing on this list is a plan.

### Money

- Every paid run starts with a quote. Nothing is charged until a second call confirms that quote. An expired quote is refused.
- That confirmation comes from your agent, not from a human click. So each account also has a daily cap on /paysh payments, reserved before anything is signed.
- Each payment has its own cap: per run for a query, per call for a provider payment.
- When Gecko pays a provider over x402, the payee must be the address pinned for that provider. A payment request that names any other payee is refused before signing.
- Every payment transaction is simulated before it is signed, and the signature covers the exact bytes that were simulated.
- Before any signature, our own process checks those bytes against a policy: which instructions, which destination, how much. Only then is the signer asked.
- A payment counts only after we read it back from the chain and see the money arrive where it should. We do not take our own logs as proof.

### Sign-in

- Chat connectors sign in with OAuth 2.1. PKCE is required, and only S256 is accepted.
- A redirect URI must exactly match one the app registered. Anything else is refused, not redirected.
- Tokens, codes and client secrets are stored as hashes, never as plain text.
- Refresh tokens rotate on every use. A replayed refresh token revokes every token issued from it.

### Data

- Each customer's data lives in its own database. Nothing is pooled across customers.
- You can delete all your stored data with one tool call, or ask us by email.
- Contact details in results, such as emails and phone numbers, are masked by default. A tool shows the full value only when asked.
- Secrets are never stored with customer data. On the hosted service they live in a secret store and are read when needed.
- Request logs record the tool, the status and a hashed account. They do not record the payload.

## How we disclose

We publish our own mistakes, including claims we had to withdraw.

Findings in other people's systems go to the maintainer first, with a reproduction. We name them only after a fix.

Read the full disclosure policy: https://github.com/GeckoVision/gecko-surf/blob/main/docs/disclosure-policy.md

## Custody today

Today, a user's wallet is a Privy server wallet that Gecko creates for that account. There is one wallet per account.

Every signature is limited by a policy: which instructions, which destinations, and how much. The policy is set at Privy when the wallet is created, and our own process checks it again before each signature.

Gecko does not send a payment from your wallet without a confirmed quote.

Moving to wallets you own is planned.