Security

We take security seriously. This page is the canonical place to report a vulnerability or read our disclosure policy.

Reporting a vulnerability

Email support@humatext.com with a description of the issue, steps to reproduce, and the affected URL or component. Subject line should start with [security].

We aim to acknowledge reports within 48 hours and triage to a fix or remediation within 7 days for high-severity issues. Please do not open a public GitHub issue with security details, disclose publicly before we've responded, or test against accounts other than your own.

In scope

• humatext.com — the production web application
• API endpoints under /api/
• Stripe and Clerk webhook handlers
• Authentication and rate-limit bypasses
• Account takeover, including session fixation
• Cross-site scripting (XSS), CSRF on authenticated endpoints, SSRF, IDOR
• Webhook signature verification flaws
• Sensitive data exposure in logs or error pages

Out of scope

• Third-party services (Vercel, Clerk, Stripe, Neon, Upstash, Sentry, OpenAI, Anthropic, Amazon Bedrock, Google Vertex AI) — report to those vendors directly
• Social engineering of HumaText staff
• Physical attacks
• Denial-of-service attacks against our infrastructure

Coordinated disclosure

If you'd like credit in a post-mortem or release note, mention it in your report and we'll include your name, handle, or keep you anonymous as you prefer once the fix ships.

Machine-readable: /.well-known/security.txt (RFC 9116).