Version 1 This document is under legal review and may change.
Security and Vulnerability Disclosure
BlackForge is a small private beta run by a small team. If you find a security problem in it, we want to hear about it, we will take it seriously, and we will treat you fairly for telling us. This page says how to report, what happens next, what we ask you not to do, and the protection you have when you follow it.
Contents
1. How to report
Email privacy@blackforge.io with "Security report" in the subject. Please do not use the in-app feedback panel for security reports; it is read by the whole team and is not the right place for something sensitive.
A useful report includes:
- what you found and why you believe it is a security issue;
- the page, address, or request involved, and the steps to reproduce it;
- what an attacker could do with it, as far as you can tell;
- how you would like to be credited, if at all.
Please do not include other people's personal data in a report. If you need to show us that data was reachable, describe how and we will confirm it ourselves. If you need to send something encrypted, say so in a first email and we will arrange a key.
The machine-readable version of this page is at /.well-known/security.txt.
2. What to expect from us
- An acknowledgement within 3 business days of your report reaching the mailbox.
- An assessment of whether we consider it a vulnerability, how severe we think it is, and roughly when it will be fixed, normally within 10 business days of the acknowledgement.
- A fix on a timeline that matches the severity. Our targets are:
| Severity | Examples | Fix target |
|---|---|---|
| Critical | Another user's private data is readable; an account can be taken over; a server secret is exposed | 7 days |
| High | Sign-in or permission checks can be bypassed; content can be changed by someone who should not be able to | 30 days |
| Medium | A weakness that needs unusual conditions or user interaction to exploit | 90 days |
| Low | Hardening gaps with no demonstrated impact | Next scheduled release |
- A note when it is fixed, and a chance to check the fix if you want to.
- Coordinated publication. You are welcome to write about what you found once it is fixed, or 90 days after your report if we have not fixed it by then, whichever comes first. We ask that anything you publish does not expose other users' data, and we are glad to review a draft.
3. What we ask you not to do
Research that follows these rules is welcome. Please:
- Use only your own accounts and your own data. Do not access, change, or delete anything belonging to another user. If you reach someone else's data by accident, stop, do not keep a copy, and tell us in the report.
- No denial of service. Do not run load tests, flood a route, or try to exhaust a resource. The AI features in particular cost real money per request; a rate limit is a boundary, not a challenge.
- No automated scanning that generates high traffic. A targeted test is fine; a crawler is not.
- Prove, then stop. Demonstrate the issue with the least possible access and no further. Do not pivot, persist, or escalate beyond what is needed to show that the problem is real.
- No social engineering, phishing, or physical attacks on our team, our providers, or our users.
- Do not test our service providers. The companies that host BlackForge and provide sign-in and AI features have their own programs and rules; testing them is not covered by this page.
- Keep it between us until it is fixed. See coordinated publication above.
- Do not ask for payment as a condition of reporting or of not publishing.
4. Safe harbor for good-faith research
If you make a good-faith effort to follow this page, we consider your research authorized. That means:
- we will not pursue or support legal action against you for it, including under computer-misuse and anti-circumvention laws;
- we treat it as compliant with our Terms of Service, so the clause in the Terms about probing the service for weaknesses without permission does not apply to research done under this page: this page is that permission;
- if a third party raises a legal claim about your research, we will make it clear that it was authorized by us; and
- we will work with you to understand and fix the issue quickly.
This protection covers research done in accordance with this page. It cannot cover the rules of other companies, and it does not apply to conduct that goes beyond what this page allows. If you are unsure whether something is in bounds, ask first.
5. What is in scope
In scope
- the BlackForge application at blackforge.io, including its sign-in page and its API;
- the preview sites under preview.blackforge.io;
- anything BlackForge itself stores or processes, as described in the Privacy Policy.
Out of scope
- the service providers named in the Privacy Policy, and any sign-in provider or capture library you connect (report those to them directly);
- findings that require a compromised device, a modified browser, or physical access;
- issues you can only cause to yourself (for example pasting a script into your own device name and seeing it run in your own browser);
- missing best-practice settings with no demonstrated impact, such as a header or a version string;
- rate-limit findings that can only be shown by flooding a route;
- reports generated by an automated tool with no analysis.
6. Rewards
BlackForge does not run a bug bounty and does not pay for reports. If you want, we will thank you by name (or handle) on this page once the issue is fixed.
7. Contact
Security reports and questions about this page: privacy@blackforge.io.