Responsible Disclosure

Email security@webcuris.com, privately, before any public disclosure. The same address is published in /.well-known/security.txt and on the About page.

• Include enough detail to reproduce: the affected route or component, the account role you were using, what you did, and what you expected to happen instead.
• Do not access, modify, or exfiltrate data belonging to other accounts. Prove the issue against your own account and stop there; a proof against your own data is enough.
• Do not run denial-of-service, brute-force, or automated scanning against the service. The testing authorization page says what is and is not permitted.
• Give a reasonable time to remediate before disclosing publicly. Ninety days is the default; ask if you need a date sooner.

Anything under webcuris.com and its subdomains is in scope: authentication and session handling, access control between accounts and organizations, the plan gates, the API and the MCP server, the SSRF guards, scan input validation, webhook delivery, and the audit chain.

Findings that this application reports about your own scanned targets are scan results, not vulnerabilities in Webcuris. Issues in third-party services this product uses (payment, email delivery) belong with those providers.

• An acknowledgement within three working days, from a person, not an autoresponder.
• A fix or a mitigation as fast as the severity warrants, and a note back to you when it ships. Fixes are listed in the changelog.
• Credit by name, if you want it, once the issue is resolved. Good-faith research under these terms will not be met with legal action.

Before reporting, check the Security Policy. Its known-limitations section documents the gaps that are already understood and deliberately disclosed. A report that restates one of those is still welcome, but it will not be news.