Security & Responsible Disclosure

1. Report a vulnerability

Email [email protected] with a concise description, affected URL, steps to reproduce, and the impact you observed. Include screenshots or logs only after removing tokens, passwords, personal data, and unrelated customer information. Do not publish an active exploit or sensitive report content before a coordinated review.

2. Stay within safe testing boundaries

Use accounts and data you own or have explicit permission to test. Stop if you encounter someone else’s private information. Do not conduct denial-of-service attacks, social engineering, destructive testing, or attempts to obtain payment or authentication secrets. This page does not grant permission to test third-party infrastructure.

3. Access controls

Generation requires a verified customer session. User data is filtered by the authenticated account identity. Administrative endpoints require a separately configured admin role or verified allowlist; an email typed into a form or a client-side role flag does not grant access.

The dashboard previews contain no customer records and do not authorize administrative actions. Authentication-provider secrets, fal.ai and Tripo credentials, and Stripe keys belong in server-side configuration and are never intended to appear in public pages.

4. Handling reports

Reports are reviewed for reproducibility, severity, and affected systems. Acknowledgment and remediation timelines depend on the issue and operational capacity; no unconfigured service-level guarantee or bounty is promised. We may ask for clarifying details or coordinate with a provider.

If you suspect your own account was compromised, contact [email protected] and use the password-reset or provider recovery options when available. Never send your password by email.