Responsible Disclosure

If you believe you have found a security vulnerability in SophionOS, please report it privately so we can investigate before public disclosure. Good-faith research is welcome, and we will not pursue or support legal action against you for it.

• Email security@sophionos.com with the subject line "Security". This is the security contact for SophionOS Cloud, and the same address the repository's SECURITY.md names. For a self-hosted deployment, contact its operator instead.
• Include steps to reproduce, the impact you believe it has, and whether any user data was accessed or could be.
• Do not include raw API keys, passwords, or session tokens; redact anything sensitive. If a secret leaked, tell us so we can rotate it: do not send the secret itself.

If you act in good faith and follow this page, we consider your research authorized, and we will not bring or support a legal claim against you for it. Good faith means:

• You test only against your own account and your own data, or a test account you created for the purpose.
• You stop as soon as you have enough evidence to demonstrate the issue, and you do not exfiltrate, retain, or share anyone else's data.
• You do not degrade, interrupt, or deny service to other users, and you do not run automated load, brute-force, or spam campaigns.
• You give us a reasonable opportunity to fix the issue before any public disclosure, and you do not disclose another person's data at any point.

This safe harbor does not cover the systems of our providers (Clerk, Supabase, Vercel, Dodo Payments, or Resend). Report issues in those services to them, under their own programs.

• Authentication and session handling on app.sophionos.com, including authorization bypass.
• Cross-user data access: any way to read or write another user's rows through the app, the REST API, or the MCP server.
• API key handling, and the plan and entitlement checks.
• Server-side request forgery, injection, and access-control flaws.
• Prompt-injection paths that cross a user boundary.

• Findings that require a compromised device, a compromised browser extension, or physical access.
• Missing security headers with no demonstrated impact, clickjacking on pages with no sensitive action, and self-XSS.
• Reports from automated scanners with no proof of impact, and rate-limit or email-bombing reports that are working as designed.
• Social engineering of the founder or any user, and physical attacks.
• Denial of service, load testing, or anything that degrades the service for others.
• Third-party services listed in Subprocessors: report to them.

We acknowledge reports within 7 days, tell you whether we consider the issue in scope, and keep you informed of progress. We aim to remediate critical issues within 30 days and lower-severity issues within 90 days, and we will tell you if a fix will take longer. Where the law requires us to notify a regulator or affected users, see the Privacy Policy, we handle that, not the reporter. We are happy to credit you in the fix notes or in the repository if you would like; just say so.

This page is product documentation, not legal counsel.

Security · Privacy · Terms · Subprocessors