Security

Reporting a problem

Email security@crux-hq.com with what you found, the steps that reproduce it, and the pages, requests or plugin version involved. Report it privately rather than in public, and leave out anyone else’s personal data. The same contact is published for tools at /.well-known/security.txt.

What happens next

• We reply within three working days to say we have your report.
• We check it, work out how serious it is, and keep you told while we fix it.
• We fix the most serious problems first, and tell you when the fix is live.
• If anyone’s data was exposed, we tell the people affected, and the authorities where the law requires it.
• Once it is fixed, we are glad to credit you by name if you would like.

We do not run a paid bug bounty.

What it covers

• crux-hq.com: the site and the workspace
• mcp.crux-hq.com and crux-mcp.vercel.app: Crux’s API and MCP server
• The Crux plugin for Figma

Problems in the services Crux runs on belong with those providers; the Privacy Policy lists them. Denial of service, social engineering, and scanner findings with no way to exploit them are out of scope.

Testing in good faith

• Use accounts and workspaces you own, or whose owner has agreed.
• Do not read, change or delete other people’s data. If you reach any, stop, and tell us what you saw.
• Do not slow the service down for others or flood it with automated requests.
• Give us a reasonable time to fix a problem before you tell anyone else about it.

We will not take legal action against research that follows these rules.