Security policy

How to report

Email johinjohny144@gmail.com with as much detail as you can share:

• The URL or feature affected
• Steps to reproduce
• What an attacker could do with the bug (impact)
• Optional: a proof-of-concept or screenshot

You can also use any of the contact methods listed in /.well-known/security.txt.

What I'll do

• Acknowledge your report within 72 hours.
• Triage the issue and give you an honest assessment of severity.
• Patch confirmed vulnerabilities as quickly as I can (usually within days for high/critical).
• Credit you in the fix commit or changelog if you want public acknowledgement.

In scope

• toolbox-kit.com and www.toolbox-kit.com
• API endpoints under /api/*
• Hosted Pro endpoints: /api/hooks/<handle>/<bucket> (Webhook Inbox), /api/mock/<handle>/<path> (Mock API Server), and /api/mcp/<handle> (Personal MCP Server). Reports of bucket/handle collision, header injection, mock-served XSS, or MCP key disclosure are particularly welcome.
• The MCP server (toolbox-mcp on npm)
• The browser extension
• The CLI

Out of scope

• Self-XSS that requires the user to paste content into their own browser
• Self-DoS in tools that process user-supplied input (ReDoS in regex tester, etc.)
• Missing security headers without a working exploit
• Automated scanner output without manual verification
• Social engineering or physical access
• Issues affecting only outdated browsers
• Vulnerabilities in third-party services (Supabase, Cloudflare, Dodo Payments) — report those to the respective vendor

Safe harbor

Good-faith security research is welcome. If you act in good faith and stay within scope:

• I won't pursue legal action.
• I won't share your identity without your permission.
• Avoid privacy violations, destruction of data, and interruption of service for other users.
• Only test against accounts you own.

Bounties

ToolBox is a solo project without a formal bounty budget. I'll offer credit and, for impactful reports, a small thank-you (free Pro subscription, swag, or a token bounty depending on severity).