Security by architecture
The core tools on GRID/JSON run entirely on the client. Your input never travels to our servers, which drastically reduces the surface area for data breaches. Even a full compromise of our infrastructure could not expose the JSON, tokens or text you paste into a tool.
Transport security
The website is served exclusively over HTTPS with modern TLS. HTTP Strict Transport Security (HSTS) is enabled in production so that browsers only ever load the site over an encrypted channel.
Content security
We use a strict Content Security Policy, subresource integrity for third-party assets where possible, and X-Frame-Options / X-Content-Type-Options headers to reduce the risk of clickjacking and MIME-sniffing.
Reporting a vulnerability
If you believe you have discovered a security issue, please report it responsibly by emailing security@devtoolkit.io. Include detailed steps to reproduce and, if possible, a proof-of-concept. We will acknowledge your report within 72 hours and keep you updated on remediation.
Responsible disclosure
- Give us reasonable time to investigate and remediate before public disclosure.
- Avoid privacy violations, service disruption or data destruction while testing.
- Do not exploit a vulnerability beyond what is necessary to demonstrate its impact.
- Do not use social engineering, phishing or physical attacks on our staff.
Recognition
We do not currently operate a paid bug bounty program, but we are happy to publicly acknowledge researchers who report meaningful security issues (with your permission).
PGP
A PGP key for security disclosures is available on request from security@devtoolkit.io.