Security

Last updated 31 October 2026

Draft for review. This page is not legal advice.

How to report a vulnerability

Write to [CONTACT EMAIL] with the subject "Security". Tell us what you found, how to reproduce it and what you think someone could do with it. We'll answer within 5 working days, keep you told as we fix it, and credit you if you'd like. Commons has no paid bounty today.

In scope

• commonsbuild.com, including the API and the MCP server.
• commons-build.app, for ways to escape the app sandbox, read another app's data, or reach a member's session.

An app that a member published may have its own bugs. Report those to its maker, or use Report on its page if it's harmful.

What we don't pursue

We won't take legal action or complain to the police about good faith research that follows these rules.

• Use your own accounts, or test accounts you made, and only look at what you need to show the problem.
• If you reach someone else's data, stop, don't keep or share it, and tell us.
• No denial of service, spam, social engineering or physical attacks, and don't break things for other people.
• Give us a fair time to fix a problem before you talk about it publicly. We suggest 90 days.

This only covers what we can promise. We can't speak for GitHub, Google, Cloudflare or anyone else.