# Vulnerability disclosure

> Page: https://docs.plotwork.dev/vulnerability-disclosure. Index of every page: https://docs.plotwork.dev/llms.txt

How to report a security problem in Plotwork, what is in scope, and what happens after you report. It is for security researchers, and for the people at a customer who find something during a review. Plotwork is run by Buun Group Pty Ltd (ABN 75 687 193 675), Australia.

Last updated: 2026-10-24

## TL;DR

| Question | Answer |
|---|---|
| Where do I report a problem in the hosted service? | security@plotwork.dev. |
| Where do I report a problem in a published package, image, Action or provider? | "Report a vulnerability" on the Security tab of its public repository under [github.com/plotwork-official](https://github.com/plotwork-official). That report is private. |
| Should I open a public issue? | No. Public issues are for bugs that are not security problems. |
| Is there a machine-readable contact? | Yes: `/.well-known/security.txt` on plotwork.dev and docs.plotwork.dev. |
| Is there a paid bounty? | No. |
| What about a privacy request? | That goes to legal@buungroup.com, as the privacy policy says. |

## What is in scope

| Part | Where to report |
|---|---|
| plotwork.dev, docs.plotwork.dev and the portal at app.plotwork.dev | security@plotwork.dev |
| The HTTP API at api.plotwork.dev and the hosted MCP server | security@plotwork.dev |
| Hosted diagrams and stable links on cdn.plotwork.dev | security@plotwork.dev |
| The local MCP server and the command line on npm | The Security tab of the package's public repository |
| The GitHub Action, the self-hosted engine image, the Claude Code plugin and the Terraform provider | The Security tab of its public repository |

A report is most useful when it shows one of the following:

- one account or organisation reading or changing another's data
- a way past sign-in, two-step sign-in, single sign-on, an API key's scope, or an organisation's role
- a diagram source, a key, a token or a secret where it should not be, such as a log, an error report or a published file
- a script that runs from a diagram, an SVG or a page of the portal
- a published package or image whose files do not match its checksums, signature or attestation

## How to test

| Do | Do not |
|---|---|
| Use accounts and organisations you made for the test | Read, change or delete anyone else's data |
| Stop as soon as you have shown the problem, and tell us what you touched | Run a denial of service test, or send enough traffic to slow the service for others |
| Keep the details private until a fix is out | Phish, call or otherwise trick people who work on Plotwork or use it |
| Send a free account's report with its email address, so we can reply | Test the providers on the [sub-processors](https://docs.plotwork.dev/subprocessors.md) page through Plotwork: report to them directly |

## What to include

| Item | Why |
|---|---|
| What is affected, and where: the address, the package and its version, or the image digest | So we look at the right thing |
| The steps to reproduce it, with the smallest request or input that shows it | So we can confirm it |
| What you expected instead | So we agree on what is wrong |
| How we can reach you, and the name to credit, if you want credit | So we can reply and thank you |

Do not send a real secret, key or someone else's personal data in a report. Describe where it was instead.

## What happens next

We acknowledge a report, confirm the problem, and fix it. For a package or an image, a fix is a new version, and a published version is never changed. We tell you when the fix is out, and agree with you when the details can be published.

## See also

| Page | Why |
|---|---|
| [Sub-processors](https://docs.plotwork.dev/subprocessors.md) | Who handles data for Plotwork |
| [Privacy policy](https://docs.plotwork.dev/privacy-policy.md) | What Plotwork collects, and how to make a privacy request |
| [Why Plotwork draws plain SVG](https://docs.plotwork.dev/why-svg.md) | Why a diagram carries no script |
| [Self-hosting the engine](https://docs.plotwork.dev/mcp/self-hosting.md) | Running the engine inside your own network |