Security & disclosure

Security and vulnerability disclosure

How to report a problem in this platform, what we promise in return, and what we have not done yet.

Last reviewed 31 August 2026

Report a security issue to us and we will not pursue legal action against you for good-faith research conducted under this policy.

Safe harbour

In scope

Out of scope

Not because these are uninteresting, but because we cannot authorize you to do them — several would harm other people’s service or someone else’s systems.

Rules we ask you to follow

What you can expect from us

StageTarget
Acknowledgement of your report3 business days
Initial assessment and severity triage10 business days
Status update cadence until resolutionevery 10 business days
Public advisory after a fix shipswithin 30 days, credited if you wish

We do not currently run a paid bug bounty. We say so rather than implying one: if a reward matters to you, decide before you spend the time. We do credit reporters in the public advisory, by name or handle, if they want it.

Report a vulnerability

Two channels. Email reaches us at security@cainstudio.online. The form below posts directly to our own API and returns a reference id, which exists because a disclosure channel that silently loses reports is worse than none — a researcher who cannot reach you publishes instead.

Threat model

We publish the threat model rather than summarising it: the trust boundaries, the adversaries we model, what each control does and does not stop, and the residual risk we accept. It names the attacks we do not currently defend against, which is the part worth reading.

Read the threat model → · Trust center · security.txt

How this platform is built

Relevant to anyone assessing us, stated without embellishment: the decision path fails closed and never converts an unknown verdict into an allow; tenant isolation is enforced at the boundary and every fabric store is tenant-scoped; API keys are stored as SHA-256 fingerprints, never in the clear; evidence records are signed so alteration is detectable; and the site runs a nonce-based Content-Security-Policy with no unsafe-inline for scripts. None of this has been reviewed by anyone outside the team — see what we don’t do yet.