Abuse & Security Reports

The private reporting channel

Send a report to bastilleworks@mailo.com, or use the form below. Bastille-C3 is operated by Elouarn de Kerros in France. The same private channel handles abuse and security disclosures.

Use it for suspected license theft or unauthorized resale, Bastille-C3 impersonation, website or support-channel abuse, or a security issue in a Bastille-C3 product. For ordinary product problems or billing matters, use support and billing.

What to include

Describe what happened, where you observed it, and when. Include the relevant product and version, URLs or listing references, and a minimal reproduction if you are reporting a vulnerability. Explain the impact you observed without testing beyond your authorization.

Provide only evidence you may lawfully share. Redact credentials, personal information and confidential client material. Do not send full license keys, passwords, API secrets or illegal files. This website form accepts text, not file uploads.

An email thread can be used for follow-up and additional redacted evidence. If more sensitive material is genuinely necessary, ask for handling instructions before sending it.

What Bastille-C3 can act on

Bastille-C3 supplies a governance layer installed on customer infrastructure. We do not provide, curate, host or manage the content of a user’s harness or LLM provider. We cannot remove material from another provider’s service or act as a general moderator of model output. Report that content directly to the responsible provider or appropriate authority.

We can examine a Bastille-C3 product issue, investigate misuse of our website or commercial entitlements, and take action within our own control and legal obligations. A report does not guarantee a particular outcome or response time. A form acknowledgement means only that a message was accepted for delivery, not that a finding has been confirmed or an account suspended.

Responsible disclosure and privacy

Keep a suspected vulnerability private while it is investigated. Use minimal, non-destructive tests in an authorized environment. Do not access another customer’s information, extract secrets or disrupt a service to prove impact.

Reports are handled under the Privacy Policy. Information may be shared with a relevant provider or authority when necessary to investigate the issue or meet legal obligations, with disclosure limited to what is needed. Do not send immediate-danger or emergency requests to this inbox in place of the appropriate emergency service.