Report a security issue

If you have found a vulnerability in Eagle Eyes Pilot, Mirada, our website, or the services behind them, please tell us directly. This address is read by the company founders only. No automated system processes it.

security@eagleeyessearch.com

What to include

What you found, where, and the steps to reproduce it. Screenshots or a short recording help. Plain email is fine. If the report is sensitive, email us first and we will arrange a secure channel; we do not publish a PGP key at the moment.

What happens next

• A founder replies within 3 business days, confirms whether we can reproduce the issue, and tells you how serious we think it is.
• Serious issues get a fix or a mitigation within 30 days. We tell you when it has shipped.
• We credit you by name if you would like that. We do not run a paid bounty program.

Scope

• Eagle Eyes Pilot (Android) and Eagle Eyes Mirada (desktop and web).
• The customer portal and website at eagleeyessearch.com and mirada.eagleeyessearch.com.
• Our backend services: licensing, account, livestreaming and telemetry relay endpoints under eagleeyessearch.com.

Out of scope: services we use but do not operate (Google Cloud, Stripe, Cloudflare, LiveKit, CalTopo), which should be reported to the provider; denial of service; social engineering of staff or customers; physical attacks; and automated scanner output with no demonstrated impact, such as missing headers or version disclosure on their own.

Rules for good-faith research

• Only test against accounts, devices and data you own or have explicit permission to use.
• Do not access, download, alter or keep data that is not yours. If you reach customer data by accident, stop and tell us what you saw.
• Give us reasonable time to fix the issue before telling anyone else. We will work with you on timing.

If you follow these rules we consider your research authorised. We will not pursue legal action against you and will not report you to law enforcement. This is consistent with our Terms of Use.