Vulnerability Disclosure Policy

Overview

ShipGate takes the security of our software and infrastructure seriously. We encourage security researchers, customers, and the broader community to help us identify vulnerabilities through responsible disclosure. This policy describes how to report vulnerabilities, what is in scope, and what you can expect from us.

Reporting

To report a vulnerability, please contact us by one of the following methods:

• Email: security@shipgate.dev (PGP key available at /pgp-key.txt)
• Security.txt: /.well-known/security.txt (RFC 9116)

Please include as much of the following information as possible:

• Type of vulnerability (e.g., injection, authentication bypass, IDOR)
• URL or component affected
• Steps to reproduce
• Proof-of-concept code or screenshots (if applicable)
• Your assessment of impact and severity

Response Timeline

• Acknowledgment: Within 48 hours of receiving your report.
• Initial assessment: Within 5 business days — we will confirm whether the report is in scope and provide an initial severity assessment.
• Status update: We will provide status updates at least every 7 days until the issue is resolved or determined out of scope.
• Resolution: We aim to resolve critical vulnerabilities within 14 days and high-severity issues within 30 days. Complex or systemic issues may take longer; we will keep you informed.
• Disclosure: We prefer coordinated disclosure. We will work with you on a disclosure timeline, typically 90 days after the fix ships.

Scope

In scope

• shipgate.dev and all subdomains (app.shipgate.dev, api.shipgate.dev)
• ShipGate CLI (@wholestack/shipgate shipgate binary)
• ShipGate VS Code extension in packages/shipgate/vscode
• GitHub Action at packages/shipgate/action.yml
• Authentication and authorization flows
• Data exposure or exfiltration vulnerabilities

Out of scope

• Third-party services we integrate with (Stripe, GitHub, Google) — report these directly to them.
• Denial-of-service attacks, brute-force attacks, and automated scanning without prior coordination.
• Social engineering, phishing, or physical attacks against ShipGate employees.
• Vulnerabilities requiring physical access to a user's device or network-level man-in-the-middle without prior access.
• Issues in user-controlled content that do not affect other users or ShipGate systems.
• Missing security headers on static marketing pages without demonstrated impact.
• Self-XSS (where the attacker is the only affected user).

Our Commitments

• No legal action: We will not initiate legal action against researchers who discover and report vulnerabilities in good faith, following this policy.
• Safe harbor: We consider responsible disclosure activities conducted in accordance with this policy to be authorized. We will not refer your research to law enforcement.
• Confidentiality: We will keep your report and identity confidential during the remediation process, unless you agree to public disclosure.
• Credit: If you would like to be credited in our security advisories or changelog, let us know. Attribution is opt-in.

Bug Bounty Program

ShipGate does not currently operate a formal bug bounty program with monetary rewards. We acknowledge researchers who report valid vulnerabilities and may provide ShipGate credits or extended Pro access at our discretion.

If you are a security researcher and believe you have found a significant vulnerability, please reach out to discuss — we are open to recognizing exceptional contributions.

Responsible Disclosure Expectations

We ask that researchers:

• Do not access or modify data belonging to other users without their explicit consent.
• Do not disrupt production services or degrade the experience for other users.
• Do not publicly disclose the vulnerability before we have had a reasonable opportunity to remediate it.
• Limit testing to systems they own or have explicit permission to test. Do not use ShipGate customers' infrastructure for research without their permission.
• Comply with all applicable laws in your jurisdiction while conducting research.

Contact

For vulnerability reports: security@shipgate.dev
For general security inquiries: same address.
PGP key: /pgp-key.txt (placeholder — replace with real key URL)