Legal document
Security and Responsible Disclosure
- Document key
- security-disclosure
- Version
- 1.0.0-draft.1
- Status
- draft
- Proposed effective date
- 2026-09-04
- Content hash
- sha256:0b34f7d9de6493355956c0e5b58c1d66edfabdba883b58991073c37fbee4fdea
Review draft — not effective. Required company facts and legal clauses remain unresolved. This version cannot be accepted or used to unlock workspace access.
Safe reporting guidance without unsupported certification or security guarantees.
Report a concern
Use the public support route and identify the request as a security report. Include a safe description, affected route or component, time observed and non-sensitive reproduction details. Do not include credentials, access tokens, personal data, customer content or destructive proof.
Research boundaries
Do not access another user or workspace, publish externally, degrade service, exfiltrate data, use social-engineering, test third-party providers, or retain data beyond what is strictly necessary to report the issue. Stop when sensitive data or cross-workspace access is encountered.
Security posture
Synquestra uses database-enforced workspace controls, private media storage and protected worker paths as implemented controls. Provider OAuth and automatic publication remain gated until their approval and deterministic verification are complete. No certification, bug-bounty payment, response-time guarantee or safe-harbour commitment is made in this draft.
Change history
- 1.0.0-draft.1 — Initial responsible-disclosure guidance; not effective.