Vulnerability Disclosure Policy

If you've found a security problem in KoalaFix, we want to hear about it. This policy explains what you can test, how to test safely, how to tell us, and what we promise in return, including that we won't take legal action against good-faith research that follows it. Words such as Space have the meanings in our Terms of Service. The "In short" lines are summaries only; the full text is what counts.

1 · What's in scope

In short: our website, the KoalaFix service and our plugin and hooks. Not our providers' own services.

In scope:

• koalafix.com;
• mcp.koalafix.com, including the MCP server, the dashboard and the API;
• any other hostname that serves the KoalaFix service; and
• the KoalaFix plugin, hooks and configuration we publish for AI clients (the latest published version).

Out of scope:

• services run by our providers, such as Microsoft Azure, Supabase, Brevo, Stripe, Cloudflare, Google and GitHub (report those to the provider);
• AI clients made by others, such as Claude Code, Codex, Cursor and Gemini CLI (report those to their makers);
• denial-of-service attacks, load testing and anything that degrades the service for others;
• social engineering, phishing or physical attacks on our people or offices;
• spam, and reports from automated scanners with no demonstrated security impact; and
• missing best-practice settings (for example, a missing header) with no demonstrated way to exploit them.

2 · How to test safely

In short: test only your own Space and accounts, never touch other people's data, and keep proof of concept to the minimum.

When you test, you must:

1. Use only your own accounts and Space. Ask us at security@koalafix.com for a test Space, or, once sign-up is open, create a Free Space. A test Space under this policy doesn't breach our one-Space rules. Test prompt injection and similar attacks only against your own Space and your own agents.
2. Never access, change, delete or keep other people's data. If you come across someone else's data or Space, stop straight away, don't save, copy or share it, and tell us.
3. Keep proof of concept to the minimum needed to show the problem. Don't move further into our systems once you've shown it.
4. Not disrupt the service. Stay within our published rate limits, and don't run high-volume automated scanning.
5. Keep it confidential until we've fixed the problem and 14 days have passed for customers to update, or until 90 days after your report, whichever is sooner, unless we agree otherwise. If we're still fixing a serious problem at 90 days, we'll ask you for more time and explain why.
6. Follow the law that applies to you.

3 · How to report

In short: email security@koalafix.com with enough detail for us to reproduce the problem.

Email security@koalafix.com. Please include:

• what the problem is and which part of KoalaFix it affects (URL, component or plugin version);
• the steps to reproduce it, and any proof of concept;
• what an attacker could do with it; and
• how to contact you, and whether you'd like to be credited.

If you need to send sensitive details, tell us in your first email and we'll arrange a secure way to share them. You can report anonymously, but then we can't update you.

4 · What we promise

In short: we'll acknowledge your report within 3 working days, keep you updated, fix confirmed problems, and credit you if you'd like.

When you report a vulnerability under this policy, we will:

• acknowledge your report within 3 working days (Melbourne);
• give you our initial assessment within 10 working days;
• keep you updated as we investigate and fix it;
• aim to fix confirmed vulnerabilities within 90 days, and sooner for serious ones;
• tell affected customers where the law or our contracts require it; and
• credit you publicly once it's fixed, if you'd like.

We don't currently pay bug bounties or other rewards.

5 · Safe harbour

In short: if you follow this policy in good faith, we won't take legal action against you.

If you make a good-faith effort to follow this policy:

• we consider your research authorised, and we won't take legal action against you or ask law enforcement to investigate you because of it;
• we won't treat it as a breach of our Terms of Service or Acceptable Use Policy;
• we won't bring a claim for circumventing technological measures, or for reverse engineering the Client Software, to the extent your research under this policy needed it; and
• if someone else takes action against you over research that followed this policy, we'll make it known that your research was authorised by us.

We can only authorise testing of our own systems. This policy doesn't authorise testing of our providers' or anyone else's systems. If you're unsure whether something is allowed, ask us at security@koalafix.com before you do it.

6 · Our own reporting duties

In short: some security problems we have to report to regulators, and we'll coordinate with you before anything is published.

If a vulnerability affects personal information, or is being actively exploited, we may have to notify customers, regulators or other authorities. For example, if our plugin or hooks count as products under the EU Cyber Resilience Act, we may have to report actively exploited vulnerabilities to EU authorities within 24 hours. We'll do that without naming you unless you agree, and we'll coordinate with you before publishing details.

7 · Contact

KoalaFix Pty Ltd (ABN 99 696 245 959, ACN 696 245 959), 425 Smith St, Fitzroy VIC 3065, Australia.

• Security reports: security@koalafix.com
• Our security.txt file: https://koalafix.com/.well-known/security.txt
• How we protect KoalaFix: https://koalafix.com/security

8 · Change log