Reporting a vulnerability

How to report

hello@winchlabs.io, with “security” in the subject.

Include what you did, what happened, and what you expected. A reproduction beats a description. If you would rather not send details in plain email, say so and we will arrange something else first.

What we commit to

• We will acknowledge you. A human, not an autoresponder.
• We will tell you what we found, including if we conclude it is not a vulnerability, and why.
• We will credit you if you want to be credited, and not if you do not.

What we do not promise

We are a small team and we do not run a bug bounty. There is no payout, and there is no formal SLA on triage or fix times. Publishing a response-time commitment we might miss during a busy fortnight would be worth less than saying this.

We also hold no SOC 2 and no ISO 27001 as a company — see data flow. If you are evaluating us against a control framework, that is the honest starting point.

Please do not

• Test against another customer’s organisation or repositories.
• Run automated scanning against the hosted environment at a volume that would affect other users.
• Access, modify or retain data that is not yours. If you encounter someone else’s data, stop and tell us what you saw and how.

The parts of the system worth your attention

Said plainly, because a researcher will find them anyway and would rather be pointed at them:

• Tenancy. Every table is org_id-scoped. A cross-tenant read is the highest-severity class of bug this product has.
• The webhook path. It is session-less and must resolve the installation’s organisation explicitly.
• The envelope. Sealed secrets are bound to their organisation row; a ciphertext that opens under a different row would be a real finding.
• SSO discovery and domain verification. A domain that routes sign-ins without proof of ownership would be a capture.

We maintain a fuller internal threat model for the SSO chain. It self-reports which defences are partial, which makes it a prioritised target list, so it stays private — but if you are doing serious work here, ask and we will talk under NDA.