Legal
Vulnerability disclosure
How to report a security problem in Plotwork, what is in scope, and what happens after you report. It is for security researchers, and for the people at a customer who find something during a review. Plotwork is run by Buun Group Pty Ltd (ABN 75 687 193 675), Australia.
Last updated: 2026-10-24
TL;DR
| Question | Answer |
|---|---|
| Where do I report a problem in the hosted service? | security@plotwork.dev (opens in a new tab). |
| Where do I report a problem in a published package, image, Action or provider? | "Report a vulnerability" on the Security tab of its public repository under github.com/plotwork-official (opens in a new tab). That report is private. |
| Should I open a public issue? | No. Public issues are for bugs that are not security problems. |
| Is there a machine-readable contact? | Yes: /.well-known/security.txt on plotwork.dev and docs.plotwork.dev. |
| Is there a paid bounty? | No. |
| What about a privacy request? | That goes to legal@buungroup.com (opens in a new tab), as the privacy policy says. |
What is in scope
| Part | Where to report |
|---|---|
| plotwork.dev, docs.plotwork.dev and the portal at app.plotwork.dev | security@plotwork.dev (opens in a new tab) |
| The HTTP API at api.plotwork.dev and the hosted MCP server | security@plotwork.dev (opens in a new tab) |
| Hosted diagrams and stable links on cdn.plotwork.dev | security@plotwork.dev (opens in a new tab) |
| The local MCP server and the command line on npm | The Security tab of the package's public repository |
| The GitHub Action, the self-hosted engine image, the Claude Code plugin and the Terraform provider | The Security tab of its public repository |
A report is most useful when it shows one of the following:
- one account or organisation reading or changing another's data
- a way past sign-in, two-step sign-in, single sign-on, an API key's scope, or an organisation's role
- a diagram source, a key, a token or a secret where it should not be, such as a log, an error report or a published file
- a script that runs from a diagram, an SVG or a page of the portal
- a published package or image whose files do not match its checksums, signature or attestation
How to test
| Do | Do not |
|---|---|
| Use accounts and organisations you made for the test | Read, change or delete anyone else's data |
| Stop as soon as you have shown the problem, and tell us what you touched | Run a denial of service test, or send enough traffic to slow the service for others |
| Keep the details private until a fix is out | Phish, call or otherwise trick people who work on Plotwork or use it |
| Send a free account's report with its email address, so we can reply | Test the providers on the sub-processors page through Plotwork: report to them directly |
What to include
| Item | Why |
|---|---|
| What is affected, and where: the address, the package and its version, or the image digest | So we look at the right thing |
| The steps to reproduce it, with the smallest request or input that shows it | So we can confirm it |
| What you expected instead | So we agree on what is wrong |
| How we can reach you, and the name to credit, if you want credit | So we can reply and thank you |
Do not send a real secret, key or someone else's personal data in a report. Describe where it was instead.
What happens next
We acknowledge a report, confirm the problem, and fix it. For a package or an image, a fix is a new version, and a published version is never changed. We tell you when the fix is out, and agree with you when the details can be published.
See also
| Page | Why |
|---|---|
| Sub-processors | Who handles data for Plotwork |
| Privacy policy | What Plotwork collects, and how to make a privacy request |
| Why Plotwork draws plain SVG | Why a diagram carries no script |
| Self-hosting the engine | Running the engine inside your own network |