Security

Vulnerability disclosure policy

Last updated: 2026-11-05

If you find a security problem in DevStride, we want to hear about it. This page explains what you can test, how to report what you find, and what you can expect from us.

Scope

This policy covers:

  • devstride.com and www.devstride.com, our website
  • app.devstride.com, the DevStride application
  • api.devstride.com, the DevStride API, including the MCP server

Services we use but don't run, such as our hosting and email providers, are out of scope. Please report problems in those services to the provider.

How to report

Email info@devstride.com with "Security report" in the subject line. Please include:

  • what you found and where (the URL, endpoint or feature)
  • the steps to reproduce it
  • what an attacker could do with it
  • how we can reach you with questions

Please give us a reasonable time to fix the problem before you share it with anyone else.

What to expect

  • We acknowledge your report within 3 business days.
  • We investigate, keep you informed of our progress, and tell you when the problem is fixed.
  • If you would like credit for the finding, tell us how you want to be named.

Testing rules

  • Don't do anything that degrades the service for others. That rules out denial-of-service attacks, load or stress testing, and high-volume automated scanning.
  • Don't access, change or delete other customers' data. Test only with accounts and workspaces you own or have permission to use. If you come across someone else's data, stop, don't keep or share it, and tell us in your report.
  • Don't use social engineering or phishing against our staff or customers, and don't attempt physical access.
  • Do only what is needed to show the problem exists.

Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorized. We won't take legal action against you or report you to law enforcement for it. If someone else takes legal action against you for research that followed this policy, we will make it known that your work was authorized.

If you're unsure whether something is allowed, ask us at info@devstride.com before you test it.

Machine-readable contact details are in /.well-known/security.txt.