Security

We build tools for the security community. If you find a vulnerability in VulnRap itself, we want to hear about it and we will fix it.

Report a Security Issue

If you discover a security vulnerability in VulnRap, please report it responsibly. Do not open a public GitHub issue for security vulnerabilities.

Contact

Email: remedisllc@gmail.com

Subject line: VulnRap Security Report

PGP key fingerprint: TBD — request via email

Our full disclosure policy — including scope, safe-harbor language, and response SLAs — is published in SECURITY.md at the repository root, and the machine-readable version is at /.well-known/security.txt per RFC 9116.

Threat Model

We publish our STRIDE-flavored threat model so you can see how we reason about the platform's security posture before you report a finding. It covers prompt injection into VulnRap, fixture poisoning, scoring oracle abuse, reviewer-token leak, and side-channel inference of stored reports.

Read it here: threat_model.md

What to Include in Your Report

Help us reproduce and fix the issue quickly by including:

Description: Clear summary of the vulnerability and its potential impact.
Steps to Reproduce: Detailed, step-by-step instructions to trigger the issue.
Affected Component: Which part of VulnRap is affected — the API, frontend, redaction engine, similarity matching, etc.
Environment: Browser, OS, or tools used to discover the issue.
Proof of Concept: Screenshots, request/response logs, or a minimal script demonstrating the vulnerability.
Suggested Fix: If you have ideas on how to address it, we would genuinely appreciate hearing them.

What to Expect

Acknowledgment Within 48 hours

We will confirm we received your report and are reviewing it.

Assessment Within 1 week

We will evaluate the severity, determine the scope, and share our initial findings with you.

Fix Varies by severity

Critical issues will be patched as fast as possible. We will keep you updated on progress.

Disclosure After the fix is deployed

We will coordinate with you on public disclosure timing. We believe in transparency.

Scope

In scope:

The VulnRap web application at vulnrap.com
The VulnRap REST API at vulnrap.com/api/*
The auto-redaction engine (bypasses that leak PII/secrets)
The similarity/hashing pipeline (collision attacks, data leakage)
Authentication or authorization flaws (even though there are no user accounts, access control matters)
Server-side vulnerabilities (SSRF, injection, path traversal, etc.)

Out of scope:

Denial of service attacks (we have rate limiting; please do not test this on production)
Social engineering of the team
Issues in third-party dependencies that do not have a demonstrated exploit path in VulnRap
Self-XSS or issues requiring physical access to the user's device

Contributing Fixes

VulnRap is open source. If you find an issue and have a fix, we welcome pull requests. For security issues, please email us first so we can coordinate the fix and disclosure responsibly.

For non-security bugs and feature requests, feel free to open a GitHub issue directly.

Thank You

We are building VulnRap for the security community. If you take the time to find and report an issue, you are making the tool better for everyone. We appreciate it and we will acknowledge your contribution (with your permission) after the fix is deployed.

Our full security.txt is available at the standard RFC 9116 location.

See also: Privacy Policy · Terms of Service