Security

1. How to report a problem

Email [email protected] with "Security" in the subject. Include:

• What you found, and where: the page, API endpoint or MCP tool.
• The steps to reproduce it.
• What someone could do with it.
• How to reach you.

Don't send other people's data. If you came across any, say so, and don't keep it.

2. What happens next

• We reply to say we have your report, usually within a few working days.
• We look into it, tell you what we find, and fix what is real.
• We tell you when it is fixed and, if you'd like, can thank you by name in the changelog.
• If people's personal data was affected, we tell those affected, or their workspace's owners, as our privacy policy says.

We don't run a paid bug bounty.

3. Research we welcome

We won't pursue or support legal action over research done in good faith that keeps to these rules:

• Test only with your own accounts and your own diagrams. Don't access anyone else's account or private diagrams, or change or delete anything of theirs.
• Don't degrade the service: no denial-of-service, no load tests and no spam.
• No social engineering of Zindex staff or users, and no physical attacks.
• Give us reasonable time to fix a problem before you tell anyone else.

4. What this covers

zindex.ai and its subdomains, including the API at api.zindex.ai and the MCP server at https://api.zindex.ai/mcp; the @zindexai/mcp npm package; and the Zindex plugin at github.com/zindexai/zindex. A problem in a service we use, such as Cloudflare, Fly.io, Neon, Stripe or Resend, is best reported to that service; tell us too if it affects Zindex.