Contact: mailto:security@trydock.ai
Contact: https://github.com/try-dock-ai/support/issues/new?labels=security&template=security.md
Expires: 2027-05-19T00:00:00.000Z
Preferred-Languages: en
Canonical: https://trydock.ai/.well-known/security.txt
Policy: https://trydock.ai/docs/security

# Dock — Vector Apps Inc.
# Thanks for taking the time to disclose responsibly.
#
# Scope:
#   - trydock.ai and *.trydock.ai
#   - The Dock REST + MCP API (trydock.ai/api/*)
#   - The Dock CLI (npm: @trydock/cli)
#   - The Dock Desktop app
#
# Out of scope:
#   - Customer workspaces / customer data (we don't permit testing
#     against accounts you don't own)
#   - Rate-limit testing / DoS / volumetric load
#   - Social engineering of Dock staff or contractors
#   - Findings already documented as known issues on
#     github.com/try-dock-ai/support
#
# What we ask:
#   - Give us a reasonable window (~14 days) to triage + patch before
#     public disclosure
#   - Don't access, modify, or exfiltrate customer data
#   - Don't run scans that disrupt service for other users
#
# What we offer:
#   - Public credit in the changelog (opt-in)
#   - No bounty program at this stage (early beta), but real
#     thank-yous + we'll work with you on coordinated disclosure