Vulnerability Disclosure Policy

Overview

ShipGate takes the security of the hosted product and infrastructure seriously. We encourage security researchers, customers, and the broader community to help us identify vulnerabilities through responsible disclosure. This policy describes how to report vulnerabilities, what is in scope, and what you can expect from us.

Reporting

Email security@shipgate.dev. Include as much of the following as you can:

• Type of vulnerability (for example injection, authentication bypass, IDOR)
• URL or component affected
• Steps to reproduce
• Proof-of-concept or screenshots, if applicable
• Your assessment of impact and severity

This deployment does not serve a /.well-known/security.txt or a public PGP key. Email is the reporting channel.

Response timeline

• Acknowledgment: We aim to acknowledge within two business days.
• Initial assessment: Within 5 business days — we will confirm whether the report is in scope and provide an initial severity assessment.
• Status update: We will provide status updates at least every 7 days until the issue is resolved or determined out of scope.
• Resolution: We aim to resolve critical vulnerabilities within 14 days and high-severity issues within 30 days. Complex or systemic issues may take longer; we will keep you informed.
• Disclosure: We prefer coordinated disclosure. We will work with you on a disclosure timeline, typically 90 days after the fix ships.

Scope

In scope

• The hosted ShipGate product on shipgate.dev and the same surfaces served from this deployment (including merge-time CI via the WholeStack GitHub App).
• Authentication and authorization flows for ShipGate accounts and workspaces.
• Data exposure or exfiltration affecting ShipGate customers or run records.
• Developer surfaces we publish on this host (CLI, MCP, VS Code, plugin pages) as they exist here — advisory local tools, not a signed public npm release.

Out of scope

• Third-party services we integrate with (Stripe, GitHub, Google) — report these directly to them.
• Denial-of-service attacks, brute-force attacks, and automated scanning without prior coordination.
• Social engineering, phishing, or physical attacks against ShipGate employees.
• Vulnerabilities requiring physical access to a user's device or network-level man-in-the-middle without prior access.
• Issues in user-controlled content that do not affect other users or ShipGate systems.
• Missing security headers on static marketing pages without demonstrated impact.
• Self-XSS (where the attacker is the only affected user).
• Claims about a public signed CLI, cosign releases, or a GitHub Action we do not publish as a customer-runnable package.

Our commitments

• No legal action: We will not initiate legal action against researchers who discover and report vulnerabilities in good faith, following this policy.
• Safe harbor: We consider responsible disclosure activities conducted in accordance with this policy to be authorized. We will not refer your research to law enforcement.
• Confidentiality: We will keep your report and identity confidential during the remediation process, unless you agree to public disclosure.
• Credit: If you would like to be credited in our security advisories, let us know. Attribution is opt-in.

Bug bounty program

ShipGate does not currently operate a formal bug bounty program with monetary rewards. We acknowledge researchers who report valid vulnerabilities and may provide ShipGate CI access or WholeStack credits at our discretion. We do not promise a named paid plan as a bounty.

If you are a security researcher and believe you have found a significant vulnerability, please reach out to discuss — we are open to recognizing exceptional contributions.

Responsible disclosure expectations

We ask that researchers:

• Do not access or modify data belonging to other users without their explicit consent.
• Do not disrupt production services or degrade the experience for other users.
• Do not publicly disclose the vulnerability before we have had a reasonable opportunity to remediate it.
• Limit testing to systems they own or have explicit permission to test. Do not use ShipGate customers' infrastructure for research without their permission.
• Comply with all applicable laws in your jurisdiction while conducting research.

Contact

For vulnerability reports: security@shipgate.dev
Controls and what we do not claim: Security overview

Talk to security