Security

Last updated: October 16, 2026

Security lead and contact

Security at Atomic BI PTE. LTD. is owned by Tobias Strebitzer, Founder & Security Lead. He is the accountable contact for vulnerability reports, security incidents and abuse notices across all of our products, and has the authority to act on them.

What we build and defend

Atomic BI PTE. LTD. is a Singapore-registered company. We build and operate the following products, and we are responsible for the security of their code and infrastructure:

  • Atomic BI : LinkedIn outreach platform (app.atomic.bi) and this website.
  • Shuttle : Open-source Chromium fork built for AI agents, with a built-in MCP server and per-agent isolated storage. Has its own security policy.
  • Silkweave Box : Team workspace in which AI agents act with delegated team credentials.

Reporting a vulnerability

If you believe you have found a security issue in any of our products, websites or infrastructure, email tobias.strebitzer@atomic.bi. For Shuttle, prefer GitHub's private advisory form linked above. Please include the affected product and version, steps to reproduce, and the impact you observed.

We acknowledge reports within 3 business days, keep you informed while we investigate, and aim to fix confirmed high-severity issues within 30 days. We will credit you in release notes if you want.

We do not currently run a paid bug-bounty program.

Safe harbor

We will not pursue legal action against researchers who act in good faith: only test accounts and systems you own or have our permission to test, do not access, modify or destroy other people's data, do not degrade our services, and give us reasonable time to fix an issue before disclosing it. If you are unsure whether something is in scope, ask first.

How we work

  • Upstream tracking. Shuttle follows Chromium stable security releases. We triage each upstream release, merge the fixes and verify that they hold on the surfaces Shuttle adds (per-agent storage partitions, session-scoped tabs, the local MCP and CDP control plane).
  • Agent control-plane hardening. Our products put AI agents in control of authenticated sessions, so we review them for the failure modes specific to that: prompt injection from untrusted web content, cross-agent storage leakage, and exposure of localhost control endpoints to web pages.
  • Dependencies and disclosures. We reproduce, validate and fix reported issues and third-party advisories before release. Only the latest release of each product receives fixes.
  • Access. Production access and privileged accounts require multi-factor authentication; credentials are issued per person, never shared, and revoked when someone leaves.
  • Data. See the privacy policy for what we collect and how it is handled.