Security

Found a vulnerability in the Thoth app, this website, the publishing API or the help center service? Please report it privately and give us time to fix it before you share details.

How to report

• Write to support@usethoth.app with “Security” in the subject. This is the address in our security.txt.
• Say what you found, where, and the steps to see it. A short proof is enough. Please don’t include real people’s data or secrets.

What to expect

• We acknowledge a report within a few days and tell you what we decide.
• We fix confirmed problems as fast as we can and will credit you if you’d like.
• We won’t take action against someone who reports in good faith and follows the rules below.

The rules

• Test only with your own account, your own guides and your own help center. Don’t test against other people’s.
• Don’t access, change or keep data that isn’t yours. Stop and tell us if you reach some.
• Don’t run anything that degrades the service: no flooding, no automated scanning of accounts or help centers.
• Don’t use social engineering or physical attacks against us or anyone else.

In scope

• The Thoth app for Windows and its installer.
• usethoth.app, my.usethoth.app and the API behind the app.
• The service that serves published help centers on thothdocs.com. The pages people publish there are their own content: report those as abuse.

Abuse, not a vulnerability

Phishing, malware or other abuse on a published help center: use the Report link on that site, or my.usethoth.app/report.