Security & Vulnerability Disclosure

Our commitment to security

Metatrix Labs operates metatrix.ai as a cloud, serverless platform, and we treat protecting your account and your creations as a core part of how we build. Our security posture includes:

• Encryption in transit. Traffic between your device and metatrix.ai is protected with TLS (HTTPS).
• Encryption at rest. Data we store on our behalf is encrypted at rest.
• Hardened session cookies. Authentication cookies are set with the HttpOnly, Secure, and SameSite=Lax attributes, so they are not readable by page scripts, are only sent over HTTPS, and are constrained on cross-site requests.
• Isolated terminal sandbox. The in-browser terminal runs inside an isolated cloud sandbox, separated from our core systems and from other users’ environments.
• Least-privilege access. Internal access to systems and data is granted on a least-privilege basis — only what is needed to operate and support the service.

These measures apply across metatrix.ai features, including Max chat, image, video, and 3D generation, camera scene-description, WebRTC calling, voice, GPS, the sandboxed terminal, and the creations gallery. No online service can promise perfect security, which is exactly why the disclosure process below matters to us. For details on how we handle personal data, see our Privacy Policy.

How to report a vulnerability

If you believe you have found a security vulnerability in metatrix.ai, we want to hear from you. Please email support@metatrix.ai with the details described below. We also publish a machine-readable policy at /.well-known/security.txt so researchers and automated tools can find the right contact quickly. Please report privately and give us a reasonable opportunity to investigate and remediate before any public disclosure.

What to include in your report

To help us reproduce and fix the issue quickly, please include as much of the following as you can:

• The affected URL, endpoint, or feature (for example, Max chat, the terminal sandbox, WebRTC calling, or the creations gallery).
• Clear, step-by-step instructions to reproduce the issue.
• A description of the impact — what an attacker could do, and what data or users could be affected.
• Any supporting proof of concept (a minimal script, request, screenshot, or short recording), kept to the least intrusive demonstration needed.
• The date and time of your testing and, if relevant, the account you used, so we can correlate logs.

Safe harbour

We value good-faith security research. We will not pursue or support legal action against researchers who act in good faith and follow this policy — meaning you avoid privacy violations, avoid degrading or disrupting the service, only interact with accounts and data that are your own, and give us a reasonable time to fix an issue before disclosing it. If you make a genuine, good-faith effort to comply and something goes wrong, we will treat it as authorized and work with you rather than against you. This safe harbour applies to your interaction with metatrix.ai and does not authorize actions against third parties or bind anyone other than Metatrix Labs.

Rules of engagement

To keep other users safe while you test, please follow these rules:

• Test only against your own account and your own data. Create a separate test account if you need one.
• Do not access, modify, or delete other users’ data, content, or communications.
• No denial-of-service or load/stress testing, no spam, no social engineering of our team, users, or vendors, and no physical attacks against facilities or hardware.
• Do not use automated scanning that degrades the service for others.
• If you accidentally access data that is not yours, stop immediately, do not save or share it, and report it to us right away.

Out of scope

Some reports fall outside this program:

• Vulnerabilities in third-party providers or their infrastructure should be reported to those providers directly. See our Sub-processors list for context.
• Non-security bugs, feature requests, and general usability issues — please send these to support@metatrix.ai as normal support.
• Theoretical issues without a realistic, demonstrable attack path, and reports that consist only of automated-scanner output without validation.
• Findings that require a compromised device, a rooted or jailbroken browser, or highly unlikely user interaction to exploit.

Our response

When you submit a valid report, we aim to acknowledge receipt within a reasonable time, investigate, and keep you updated on our progress toward a fix. Timelines depend on the severity and complexity of the issue. With your permission, we are happy to credit you once the issue is resolved.

Recognition

We currently offer recognition rather than a paid bounty. We are grateful for responsible disclosure and will acknowledge researchers who help us improve, with their consent. Any reward is at our discretion and is not a contractual entitlement.

Contact

Metatrix Labs is based in Ontario, Canada. To report a vulnerability or ask a security question, contact support@metatrix.ai, and see our machine-readable policy at /.well-known/security.txt. For how we handle personal data, read our Privacy Policy.