Responsible disclosure policy

We welcome reports from security researchers and treat them as a partnership, not a threat.

Send findings to [email protected] (PGP available on request).
Machine-readable contact: /.well-known/security.txt (RFC 9116).
We aim to acknowledge within 3 business days and provide a triage update within 10 business days.
We will not pursue legal action against researchers who follow this policy in good faith.
Please test only against your own accounts/data, avoid privacy violations, service degradation, and data exfiltration.
Out of scope: social engineering of staff, physical attacks, denial-of-service, automated scanner output without proof of impact, issues on third-party providers (report to them directly).
We do not currently run a paid bug bounty, but we publicly credit researchers who request it.

Security baseline

Authentication and row-level access policies protect user and workspace data.
Payment webhooks verify signatures and are idempotent.
AI and public endpoints are rate-limited with abuse prevention.
Secrets are stored server-side only and are never committed to source control.
Error and performance monitoring avoids unnecessary PII and masks sensitive user inputs.

Encryption

Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest where supported by our infrastructure providers.

Backups

Encrypted backups are maintained for business continuity and are periodically tested for recoverability.

Access control

Access to production systems, databases, and deployment pipelines is restricted to authorized personnel and reviewed regularly.

Report a vulnerability

Email [email protected] with a description, impact, affected URL, reproduction steps, and your contact details. Please do not access, modify, or exfiltrate data that is not yours. We aim to acknowledge reports within 3 business days.

Security headers

We configure Content-Security-Policy, frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and HSTS at the hosting and CDN layer. Headers are reviewed regularly as part of release readiness.

Incident response

We maintain an incident response process for identifying, containing, and recovering from security events. In case of a personal-data breach, affected users and relevant authorities will be notified where required by GDPR Articles 33 and 34.

No guarantee

We work to protect the service but cannot promise absolute security. Please do not submit secrets or sensitive third-party data unless strictly needed and contractually covered.