Security

Report a vulnerability

Email JMcMahan@jmcmahanllc.com with "Security" in the subject. The same address is in our security.txt.

Please include a description of the issue and its impact, the steps to reproduce it (the URL or API endpoint, and the kind of account you used), and any proof of concept. Do not include real customer data beyond what is needed to show the issue.

Ask before you test

Our Terms of Service do not allow probing, scanning or testing the service without our prior written consent. If you found something by accident, stop, write down what you saw and email us. If you want to test, say what you want to test and wait for our written reply: that reply is your authorization, limited to what it says.

Do not open a public issue, post the details publicly, access another customer's workspace or data, or degrade the service.

Safe harbor

We have not yet adopted formal safe-harbor terms. Today the only authorization to test is the written consent described above. Nothing on this page authorizes access to another customer's data.

What to expect

We read every report. We will tell you how we assess its severity and when we expect to fix it, keep you updated, and credit you if you wish. We do not run a bug bounty.

Scope

In scope: the web app, the REST API, the MCP server, outbound webhooks, and the billing and signup flows.

Out of scope: third-party platforms we build on (report to them directly), customers' own systems and AI clients, social engineering, physical attacks and volumetric denial of service. The separate field-sales mobile app is out of scope here, but report an issue in it the same way, to the same address.

Customers

Our draft policies, control matrix and evidence are available to customers under a non-disclosure agreement, on request. Ask your account contact.