1How to report
Email [email protected]. Please include what you found and where (the page, address, API endpoint, CLI version or app), the steps to reproduce it, and what an attacker could do with it. Encrypted reporting is available: ask for our PGP key first.
Do not report vulnerabilities in public issues, forums or social media before we have fixed them. Do not include other people's personal data in a report beyond what is needed to show the problem.
2What is in scope
- Pugi surfaces
- pugi.io, app.pugi.io, logo.pugi.io, the Pugi API and MCP server, the Pugi Code CLI, the Pugi desktop apps and browser extensions, and the public Pugi skills and plugin repositories.
- Your own apps
- Apps on *.pugi.app or on your own domain that belong to your Pugi account.
3What is out of scope
- Other people's apps
- Apps on *.pugi.app or custom domains that belong to someone else. Report a suspected problem with them to us, but do not test them.
- Disruptive testing
- Denial of service, load or stress testing, spam, and anything that degrades the service for other customers.
- People
- Social engineering, phishing of our staff or customers, and physical attacks.
- Third-party services
- Services we use but do not run, such as our payment, email or hosting providers. Report those to the provider.
4Reporting is not permission to test
This page tells you where to send a report. It does not authorise you to access, scan, or attack any system, account, or data that you do not own. Only the owner of a system can authorise testing of it.
If you have an account, you may test your own account and your own projects in a way that does not affect anyone else. Do not access, change or delete data that is not yours. If you reach someone else's data by accident, stop, do not keep a copy, and tell us.
Pugi's own security checks and pentests run only against apps, sites and repositories that the customer owns or is authorised to test. The Acceptable Use Policy sets out that rule.
5What we commit to
We acknowledge your report within 72 hours, keep you informed while we fix it, and tell you when the fix ships.
We follow a 90-day coordinated disclosure window from your first report. If a fix needs longer, we will explain why and agree a new date with you.
If you want, we credit you by name when we publish the fix.
We will not pursue legal action against you for research that follows this page in good faith: you stay in scope, you avoid harm to people and data, and you give us a reasonable time to fix the problem before you disclose it. We cannot bind third parties, and this does not cover activity that breaks the law.
6Contact
Security reports: [email protected]. Everything else: [email protected]. Our security.txt is published at app.pugi.io/.well-known/security.txt.