Responsible Disclosure
If you believe you found a security or privacy issue in EXFILTR, report it to hello@exfiltr.ai. Include the affected URL, product, steps to reproduce, and potential impact.
Do Not Attack Production Systems
Do not perform denial-of-service testing, destructive testing, credential attacks, social engineering, spam, phishing, or attempts to access data that does not belong to you.
No Bounty Program Yet
EXFILTR does not currently operate a bug bounty program and does not promise payment for reports unless explicitly stated in writing.
Current Security Posture
EXFILTR is early-stage software. The current public website is static. Internal automation uses environment variables and managed secrets rather than committed credentials.
Browser Extension Principles
- Request the narrowest practical permissions.
- Explain permissions before Chrome Web Store submission.
- Avoid remote code.
- Keep data local where practical.
- Do not collect page content unless the product requires it and discloses it.
Secret Handling
Secrets should live in managed secret storage, local environment files excluded from git, or another appropriate secret manager. Secrets should not be committed, pasted into public comments, logged, or exposed in static website files.
Checklist
The internal repository security checklist is maintained privately and reviewed before public release steps.