# Responsible disclosure

**Codelux AI** — policy version 1, 28 September 2026. Same commitments as the `SECURITY.md`
published with the plugin repository on GitHub (codeluxai/codelux).

## How to report

Write to **hello@codelux.ai** with the subject **"Security"**. Please do not open a public
issue, post on social media or contact other users about it before we have fixed it.

Include:

- what you found and how to reproduce it (steps, requests, a proof of concept);
- the Codelux version (Account tab in the app) and your operating system;
- which part is affected: the app on your machine, the website / API at codelux.ai, or the
  Team realtime service;
- whether you want to be credited, and under which name.

If you need to send something sensitive, say so in a first email and we will agree a way to
exchange it.

## What we commit to

| Step | When |
|---|---|
| Acknowledgement of your report | within 3 business days |
| First assessment (confirmed or not, severity) | as soon as it is reproduced, usually within 10 business days |
| Fix or mitigation plan for a confirmed issue | within 30 days |
| Notice to you when the fix is released | at release |
| Credit in the changelog, if you want it | at release |

We will keep you informed if a fix takes longer, and tell you why. Customers affected by a
confirmed issue that exposed their data are notified as set out in our data processing
agreement.

There is **no paid bug bounty** at this time.

## Scope

In scope:

- the Codelux app (all platforms): the local dashboard and API on loopback, the MCP endpoint,
  the CLI, the Claude Code plugin and its hook scripts;
- the website and API at `codelux.ai`, including sign-in, registration, the account
  dashboard, downloads and billing flows;
- the Team realtime service at `rt.codelux.ai`;
- the end-to-end encryption of team data and the team-key exchange.

Out of scope:

- third-party services we use (Cloudflare, Stripe, the email provider, jsDelivr) — report
  those to their owners;
- the AI agents and providers you use with Codelux;
- findings that need physical access to an unlocked machine, or malware already running as
  the same user on that machine (the local app trusts its own machine user; see the security
  questionnaire, E9);
- denial of service by volume, spam, social engineering of us or of users;
- missing best-practice headers or banners without a demonstrated impact;
- known limits already documented in the security pack (for example: binaries not
  code-signed yet, local project databases not encrypted by the app).

## Rules for testing

- Test only against **your own accounts** and your own machines. Create a Free account for
  testing; do not access, modify or delete data of other users.
- Stop and report as soon as you reach data that is not yours.
- No automated scanning at a rate that degrades the service; keep to a few requests per
  second.
- Do not test the payment flows with real cards other than your own, and do not attempt
  to obtain paid licences without paying.
- Give us the time above to fix the issue before any disclosure; we will agree a publication
  date with you.

## Safe harbour

If you act in good faith and follow these rules, we will not take legal action against you
and will not ask anyone else to, for the research you report to us. If in doubt about
whether something is allowed, ask first at hello@codelux.ai.