Legal

Security

• Business Terms of Service
• Privacy Policy
• Acceptable Use Policy
• Security

Last Updated: 22 September 2026 | v1

1. Reporting a Vulnerability

Report suspected vulnerabilities to security@spike.app. Include the affected surface, reproduction steps, and any proof-of-concept you have. We acknowledge reports within three business days.

Do not exploit a vulnerability beyond what is necessary to demonstrate it, access or modify another party's data, degrade the Service for others, or disclose the issue publicly before we have had a reasonable opportunity to remediate. Good-faith research conducted within these limits will not be pursued as a violation of the Acceptable Use Policy.

2. Reporting a Compromised Account

If you believe an account has been compromised or accessed without authorization, or you observe suspicious agent behavior or a suspected prompt-injection event, notify security@spike.app immediately. See Business Terms §10.

3. How Spike Is Built

Spike runs your work locally. Files, repositories, credentials, and most agent execution stay on your device; the hosted control plane holds identity, permission, approved organizational memory, and synchronization state.

• Secrets are held in the operating system credential store, never in application storage.
• Operations that touch the filesystem, processes, or credentials cross an explicit trust boundary rather than running in the application layer.
• Agent actions are recorded as evidence-backed receipts, so what an agent did is auditable after the fact.
• Model providers receive a bounded context, not unrestricted access to your device.

4. Contact