Security & Responsible Disclosure

• All traffic to the website and API is encrypted with HTTPS.
• Passwords are stored only as salted one-way hashes. We never see or store your Google or GitHub password or access tokens.
• Sign-in sessions are listed per device in your account, so you can see and revoke them.
• Access to production systems and providers is limited to the people who need it, with strong authentication.
• Database backups are encrypted and kept in private storage.
• We keep security logs for 180 days to investigate problems, and we have an incident response plan with legal reporting deadlines.
• User content is sanitised before display, and we apply rate limits and security headers.

• Use a long, unique password, or sign in with Google or GitHub.
• Sign out devices you no longer use from Settings.
• Never paste API keys or passwords into a bide. The extension warns you if it spots one, but check yourself.
• We will never ask for your password by email or message.

If you believe you have found a security vulnerability in PromptAbide, please email hello@promptabide.com. Include:

• a description of the issue and its impact;
• the steps to reproduce it, the affected URL or component, and any proof-of-concept; and
• how you would like to be credited, if at all.

Our machine-readable contact details are in /.well-known/security.txt.

In scope: www.promptabide.com, our API, and the PromptAbide browser extension.

Please do:

• test only against your own accounts, or accounts you have permission to use;
• stop and report as soon as you can show the issue, and access no more data than you need to prove it; and
• give us reasonable time to fix the issue before sharing it publicly. We suggest 90 days, or sooner once it is fixed.

Please do not:

• access, change or delete other users’ data, or keep any data you come across;
• run denial-of-service, load or volume testing, spam, or automated scans that degrade the service;
• use social engineering, phishing or physical attacks against our team or users; or
• test our third-party providers (such as Vercel, Render, Neon, Cloudinary, Google or GitHub). Report issues in their services to them.

Usually out of scope: missing best-practice headers without a demonstrated impact, self-XSS, clickjacking on pages with no sensitive actions, rate limits on non-sensitive endpoints, email SPF/DMARC settings, and reports from automated scanners without a working proof.

• We will acknowledge your report within 3 business days and keep you updated.
• We will not take legal action against you, or ask others to, for research done in good faith under these rules. If a third party takes action, we will make it clear you acted with our authorisation.
• With your permission, we will credit you once the issue is fixed.