Thank you for helping keep CueGrove, PromptDock, and their users safe.
Please report suspected vulnerabilities privately by email:
- Contact: security@cuegroveapp.com
- Subject:
[Security] Short description - Scope: PromptDock,
cuegroveapp.com, the CueGrove Early Access API, and the administrator console
Include the affected component and version, reproduction steps, potential impact, and only the evidence needed to understand the report. Please do not include real passwords, access tokens, or unnecessary personal information.
- Do not access, modify, or download data that is not yours.
- Do not perform denial-of-service, spam, social engineering, or tests that affect normal users.
- Do not use automated scanning at a volume that degrades the service.
- Keep exploitable details private until we confirm a fix or agree on a disclosure date.
For good-faith security research that follows these boundaries, seeks to avoid harm, and is reported promptly, CueGrove will not pursue legal action based on that research alone. This statement does not authorize illegal activity, infringement of third-party rights, or service disruption.
Our response targets are:
- acknowledgement within 5 business days;
- initial triage within 10 business days;
- status updates when there is meaningful progress or at least every 14 days during an active investigation.
Resolution time depends on severity, complexity, and release constraints. We will coordinate disclosure timing with the reporter and credit them when requested and appropriate.
PromptDock is currently in Early Access. Security fixes are provided in the latest available build. Once public versioned releases begin, this section will list supported versions and update channels.
The public CueGrove Security Commitment documents current controls, known gaps, and the one-year security roadmap.
Dependency review, production dependency auditing, repository history secret scanning, and scheduled update proposals run through GitHub. Blocking thresholds, finding handling, and any time-limited exception are documented in SUPPLY_CHAIN_SECURITY.md.
感谢你帮助保护 CueGrove、PromptDock 及其用户。
请通过电子邮件私下报告疑似漏洞：
- 联系邮箱： security@cuegroveapp.com
- 邮件主题：
[Security] 简短问题描述 - 适用范围： PromptDock、
cuegroveapp.com、CueGrove Early Access API 和管理后台
请尽量包含受影响的组件和版本、复现步骤、潜在影响及理解问题所需的证据。请勿发送真实密码、访问令牌或不必要的个人信息。
- 不要访问、修改或下载不属于你的数据。
- 不要进行拒绝服务、垃圾邮件、社会工程或影响正常用户的测试。
- 不要以降低服务质量的频率运行自动扫描。
- 在我们确认修复或共同约定披露时间前，请保留可利用的技术细节。
对于遵守上述边界、以避免伤害为目的并及时报告的善意安全研究，CueGrove 不会因为该研究本身采取法律行动。本说明不授权违法活动、侵犯第三方权益或破坏服务。
- 5 个工作日内确认收到；
- 10 个工作日内完成初步分级；
- 调查期间在有实质进展时更新，或至少每 14 天提供一次状态。
修复时间取决于严重程度、复杂度和发布条件。我们会与报告者协调披露时间，并在报告者希望且适当的情况下公开致谢。
PromptDock 目前处于 Early Access 阶段，安全修复会提供在最新可用构建中。开始公开版本化发布后，本节会列出受支持版本和更新渠道。
公开的 CueGrove 安全承诺 会持续说明当前保护、已知差距和一年安全路线图。
GitHub 会自动执行依赖变更审查、生产依赖漏洞审计、完整仓库历史凭据扫描和定期更新建议。阻断标准、问题处理方式和任何有期限的例外均记录在 SUPPLY_CHAIN_SECURITY.md。