Vulnerability disclosure policy
How to report a security issue to Mushy and what to expect from us.
Current version 1.0 · Effective
Under legal review
Scope
This policy covers mushymarketing.com and its subdomains, including:
- social.mushymarketing.com — the Mushy app and its API.
- mcp.social.mushymarketing.com — the MCP server.
- auth.mushymarketing.com — the sign-in host.
Services operated by other companies, such as the social networks you connect, are outside this scope. Report issues in those services to their operators.
How to report
Email [email protected] with the subject “Security report”. Include:
- The affected host and feature.
- What you found and the possible impact.
- Steps to reproduce the issue, with a minimal example if you can provide one.
- Relevant times and request IDs, if available, and redacted screenshots or logs that help explain the issue.
- How we can contact you with questions.
Never send passwords, tokens or other people’s personal data. Use your own accounts and workspaces to demonstrate the issue. If you encounter someone else’s data, stop testing and report what happened without copying or changing it.
Safe harbour
[Counsel to complete]
Response
We answer security issues within 2 hours, any day. We may ask for more information to reproduce the issue and assess its impact. This is our response target, not a promise to fix every issue within 2 hours. We will discuss next steps with you by email.
No bounty
We do not offer a bug bounty or payment for vulnerability reports.
Disclosure
Please coordinate disclosure with us by email so we can address the issue before details are made public. We describe fixed security issues in the docs changelog without exploitable detail.