> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mokaru.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How to report security vulnerabilities in Mokaru

We take security seriously. If you've found a vulnerability, please report it to us so we can fix it before bad actors can exploit it.

## Contact

**Email**: [security@mokaru.ai](mailto:security@mokaru.ai)

We respond within **48 hours** on business days. Critical vulnerabilities (anything affecting user data, authentication, or payment processing) are triaged immediately.

## Scope

We accept reports for vulnerabilities in any of these:

| Asset                             | Scope                        |
| --------------------------------- | ---------------------------- |
| `mokaru.ai`                       | Marketing site               |
| `app.mokaru.ai`                   | Main web application         |
| `api.mokaru.ai`                   | Public REST API + MCP server |
| `docs.mokaru.ai`                  | This documentation site      |
| Mokaru mobile app (iOS / Android) | When released                |
| Mokaru browser extension          | Chrome / Firefox             |

**Out of scope**:

* Third-party services we use (Stripe, Clerk, Azure, Upstash, etc.) - report those directly to the vendor
* Social engineering of Mokaru employees
* Physical attacks
* Denial of service attacks (please don't run load tests on our production environment)
* Self-XSS / clickjacking on pages without sensitive actions
* Issues that require physical access to a user's device

## What to include

A good report contains:

1. **Description** of the vulnerability and its impact
2. **Steps to reproduce** - clear enough that our engineers can verify it
3. **Affected URL(s)** or component(s)
4. **Proof of concept** if applicable (screenshots, video, code)
5. Your **contact information** for follow-up questions

If the vulnerability is severe, please **encrypt sensitive details** using our PGP key (available on request) and only send proof-of-concept code via a private channel.

## Disclosure policy

* We follow **coordinated disclosure**.
* Please give us reasonable time to fix the issue before going public - typically 90 days, or sooner if we've already patched and notified affected users.
* We will publicly credit you in this page's hall of fame (below) unless you prefer to stay anonymous.

## Good-faith safe harbor

We will not pursue legal action against researchers who:

* Make a good-faith effort to avoid privacy violations, data destruction, or service interruption
* Only access the minimum data necessary to demonstrate the vulnerability
* Don't disclose the issue publicly before it's fixed
* Don't exploit the vulnerability for personal gain or to harm Mokaru users

If you accidentally access user data while testing, **stop immediately** and contact us. We treat accidental access reported in good faith as part of the disclosure, not as a separate incident.

## What we ask you not to do

* Don't access, modify, or delete data that isn't yours
* Don't run automated scanners against `app.mokaru.ai` or `api.mokaru.ai` without coordinating with us first
* Don't perform any test that could degrade service for other users
* Don't pivot to other systems or services through a vulnerability

## Hall of fame

Researchers who have responsibly disclosed vulnerabilities to us will be listed here once we have our first valid disclosure. (Be the first!)