Responsible Disclosure Policy
Overview
ThinkKits takes the security of our platform seriously. We welcome responsible disclosure of vulnerabilities by security researchers. If you believe you've found a security issue in any ThinkKits service, we want to hear from you.
We commit to working with researchers who follow this policy. We will not take legal action against you for security research conducted in accordance with this disclosure policy.
Report a Vulnerability
security@thinkkits.comPlease encrypt sensitive reports using our PGP key (available on request).
Scope
In Scope
- platform.html and all *.thinkkits.com domains
- api.py — ThinkKits REST API endpoints
- Authentication and session management
- Authorization and access control (tier enforcement)
- Data exposure or leakage vulnerabilities
- Cross-site scripting (XSS), CSRF, injection flaws
- Server-side request forgery (SSRF)
- Business logic vulnerabilities (tier bypass, rate limit evasion)
Out of Scope
- Third-party services: Clerk, Stripe, Supabase, Neo4j (Railway), Pinecone, Railway
- Social engineering or phishing attacks
- Denial of service (DoS/DDoS) attacks
- Physical attacks on infrastructure
- Vulnerabilities in outdated browsers
- Missing security headers that don't lead to exploitable vulnerabilities
- Clickjacking on pages with no sensitive actions
- Content spoofing or text injection without impact
Response Timeline
What to Include in Your Report
- Description of the vulnerability and its potential impact
- Step-by-step reproduction instructions
- Affected URL(s), endpoint(s), or component(s)
- Screenshots or proof-of-concept code (if applicable)
- Your assessment of severity (Critical, High, Medium, Low)
- Your preferred contact method for follow-up
Rules of Engagement
To qualify under this policy, you must:
- Not access, modify, or delete data belonging to other users
- Not perform actions that could degrade service availability
- Not use automated scanning tools at high volume against production systems
- Stop testing and report immediately if you access user data unintentionally
- Not publicly disclose the vulnerability before we've had a chance to fix it
- Act in good faith to avoid privacy violations and disruptions
Safe Harbor
We consider security research conducted in accordance with this policy to be authorized. We will not pursue civil or criminal action against researchers who comply with the rules above. If legal action is initiated by a third party, we will take steps to clarify that your actions were authorized under this policy.
Recognition
We are grateful for the security research community. Researchers who report valid vulnerabilities responsibly may be recognized in our Hall of Fame below (with your permission). We do not currently offer a monetary bug bounty, but we are evaluating a formal program.
Hall of Fame
No submissions yet. Be the first to responsibly disclose a vulnerability and earn your place here.
Contact
Security reports: security@thinkkits.com
General security questions: compliance@thinkkits.com
Security documentation: Security Overview