Do not open public GitHub issues for security vulnerabilities.

If you discover a security vulnerability in DLBrowser, please email us at:

dev@dekryptlabs.com

You should receive a response within 48 hours. If you do not, please follow up to ensure your message was received.

• Description of the vulnerability
• Steps to reproduce (proof of concept preferred)
• Affected versions
• Potential impact
• Any suggested remediation (optional)

• We will acknowledge receipt within 48 hours
• We will investigate and provide an estimated timeline for a fix
• We will coordinate a disclosure date with you when the fix is ready
• We will credit you in the release notes (unless you prefer anonymity)

This policy applies to:

• The DLBrowser core engine (src/hermes_browser/)
• The MCP server (src/dlbrowser_mcp/ and mcp_server.py)
• The Chrome extension (extension/)
• The MCP connector (connect/)
• The self-serve dashboard (web/app.py)

It does not apply to third-party dependencies (report those to their respective maintainers).

DLBrowser takes security seriously. Key architectural decisions:

• API keys: SHA-256 hashed at rest. Never stored in plaintext.
• Credit reservations: Atomic operations with process-wide lock. 0% billing overshoot.
• Webhooks: HMAC-SHA256 signed with per-org secrets. Dead-letter queue for failed deliveries.
• Spend authority: Per-user, per-txn, and daily caps with kill switch. Full audit trail.
• Self-hosted option: The managed gateway never sees user data when self-hosting. Data stays on the customer's infrastructure.
• Paywall: Structured error envelopes (401/402/403). No billing information leaked in error responses.

We follow a 90-day coordinated disclosure timeline:

1. Vulnerability reported → acknowledged within 48 hours
2. Fix developed → tested within 30 days
3. Fix released → public disclosure coordinated with reporter
4. Details published 90 days after the fix release (unless otherwise agreed)

We consider security research conducted under this policy to be:

• Authorized under applicable law
• Exempt from DMCA anti-circumvention provisions
• A legitimate contribution to our security

We will not pursue legal action against researchers who follow this policy.