# Security policy

Please report vulnerabilities privately to **security@checkbox.site** (also listed at
https://app.checkbox.site/.well-known/security.txt). Include the affected component (API, MCP server, SDK, plugin),
steps to reproduce and the impact you see. Do not include real customer data or another person's keys.

We acknowledge reports within three business days and keep you updated until a fix ships. Please give us a
reasonable time to fix the issue before disclosing it publicly. Do not run tests that degrade the service for others
or access data that is not yours.

If you find a leaked Checkbox key (`ck_live_…`, `ck_test_…`, restricted `ckr_live_…` / `ckr_test_…`, older restricted `rk_…`), report it to the same address; we revoke it.