# Security and conduct

## What this software does

Subio Scrape opens a browser on the user's own machine and reads the pages a
signed-out visitor is shown on X, LinkedIn and Hacker News. It runs locally.
There is no server, no account, no API key and no telemetry; nothing leaves the
machine except the page requests themselves and whatever the user's agent then
does with the result.

## What it will not do

These are enforced in code, not merely intended. Each has a line in the source
that would have to be deleted to break it.

- **It never signs in.** Session cookies (`auth_token`, `ct0`, `twid`, `li_at`,
  `li_rm`, `JSESSIONID`, `liap`) are deleted from its browser profile before
  every run — so even a profile a user once signed into by hand reads signed out.
- **It does not disguise itself.** No user-agent spoofing, no stealth plugins, no
  fingerprint patching. When a site answers a headless browser with a 403, the
  documented fix is to run an ordinary visible browser, not to hide the
  automation.
- **It does not get past challenges.** A CAPTCHA or interstitial ends the read
  and is reported.
- **It does not retry a refusal.** A 403, 429, challenge or sign-in wall stops
  the run; the sources not yet read are reported as skipped, with a note not to
  retry them.
- **It paces itself.** One page load at a time, a minimum gap per host, jittered.

The one deliberate exception is opt-in and documented as such:
`SUBIO_MCP_ISOLATE=1` opens a throwaway browser profile per account, which resets
a cookie-scoped guest quota. It is off by default, and the README says plainly
that this is working around a limit rather than respecting one.

## If you believe this is being used against you

If you operate a site this reads and you want to raise something — a load
concern, a robots or terms question, a request to remove support for a source —
open an issue at
<https://github.com/alijancb/subio-mcp/issues>, or email the address on the
maintainer's GitHub profile. Requests from site operators get priority over
feature work.

## Reporting a vulnerability

Report privately rather than in a public issue:

- Use GitHub's **[Report a vulnerability](https://github.com/alijancb/subio-mcp/security/advisories/new)**
  form, or
- email the address on the maintainer's GitHub profile.

Please include what you did, what happened, and what you expected. Expect an
acknowledgement within a few days.

Things worth reporting: anything that causes the server to sign in, to send data
somewhere it should not, to execute content from a scraped page, or to write
outside its own profile and cache directories. Scraped pages are untrusted input,
and text from them is data — if you find a path where it becomes an instruction
or a command, that is a vulnerability.

## Using it responsibly

Reading public pages is not the same as being allowed to do anything with what
you read. The tool does not enforce this and cannot; the person running it is
responsible for:

- the terms of the sites they point it at;
- the law where they live, and where the people whose posts they collect live —
  including the GDPR, which treats public posts about identifiable people as
  personal data;
- what happens to the collected posts afterwards: storage, republication,
  training, profiling.

Do not use it to build a dossier on a private individual, to evade a block, or to
collect at a volume the source has told you it does not want.