Security

Found a vulnerability in the Thoth app, this website, the publishing API or the help center service? Please report it privately and give us time to fix it before you share details.

How to report

• Write to support@usethoth.app with “Security” in the subject. This is the address in our security.txt.
• Say what you found, where, and the steps to see it. A short proof is enough. Please don’t include real people’s data or secrets.
• One problem per report, in English, please. If you aren’t sure whether something is allowed, ask us before you try it.

What to expect

• Within 3 business days we reply to say we have your report.
• Within 10 business days we tell you whether we can confirm the problem and how serious we think it is.
• We aim to fix a confirmed problem within 7 days if it’s critical, 30 days if it’s high, and 90 days if it’s medium or low.
• Until it’s fixed, we update you at least every 2 weeks.
• We credit you when it’s fixed, if you’d like. We don’t run a paid bug bounty.

Sharing what you found

We agree a date with you. Unless we agree otherwise, you can share details once the fix is out or 90 days after your report, whichever comes first. If a fix needs longer, we’ll ask you before that date.

Safe harbor

If you follow this policy, we treat your research as authorized. We won’t take legal action against you or ask anyone else to, and we won’t treat it as a breach of our terms. If someone else takes action against you for research that followed this policy, we’ll make it known that we authorized it.

The rules

• Test only with your own account, your own guides and your own help center. Don’t test against other people’s.
• Don’t access, change or keep data that isn’t yours. Stop and tell us if you reach some.
• Once you’ve shown the problem, stop. Don’t use it to get further in, and delete anything you got through it once you’ve reported it.
• Don’t run anything that degrades the service: no flooding, no automated scanning of accounts or help centers.
• Don’t use social engineering or physical attacks against us or anyone else.
• Don’t share details before the date we agree.

In scope

• The Thoth app for Windows and its installer.
• dev.usethoth.app, my.dev.usethoth.app and the API behind the app.
• The service that serves published help centers on thothdocs.com. The pages people publish there are their own content: report those as abuse.

Out of scope

• Problems in the services we use, such as Clerk (sign-in), Stripe (payments), Vercel and Cloudflare (hosting): report those to them. How we’ve set those services up is in scope.
• Denial of service, load testing and spam.
• Output from automated scanners without a working proof.
• Missing headers, cookie flags or email settings (SPF, DKIM, DMARC) with no shown impact.
• Clickjacking on pages with no sensitive action, self-XSS, and forcing someone to sign out.
• Anything that needs a compromised device, an out-of-date browser or physical access.
• Version numbers or banners on their own.

Abuse, not a vulnerability

Phishing, malware or other abuse on a published help center: use the Report link on that site, or my.dev.usethoth.app/report.