Skip to content
CraftLingua

Security Policy

Responsible Disclosure — SP Digital LLC

Reporting a Vulnerability

If you discover a security vulnerability in CraftLingua, please report it privately by emailing security@craftlingua.app. Do not open a public issue or disclose the vulnerability publicly until it has been resolved.

Please include as much detail as possible: a description of the issue, steps to reproduce, potential impact, and any supporting evidence such as screenshots or proof-of-concept code.

What to Expect

  • Acknowledgment: We aim to acknowledge receipt of your report within 3 business days.
  • Assessment: We will investigate and assess the severity of the issue as quickly as possible.
  • Resolution: We will work to resolve confirmed vulnerabilities in a timely manner and keep you informed of our progress.
  • Disclosure: We will coordinate with you on the timing and content of any public disclosure once a fix is in place.

Scope

The following are in scope for responsible disclosure:

  • The CraftLingua web application at craftlingua.app
  • The CraftLingua API
  • Authentication and account security
  • User data handling and privacy

The following are out of scope:

  • Third-party services and infrastructure (Stripe, Resend, Replit hosting, etc.)
  • Denial-of-service attacks or automated scanning
  • Social engineering attacks targeting SP Digital LLC staff
  • Physical security

Safe Harbor

SP Digital LLC will not pursue legal action against researchers who discover and report security vulnerabilities in good faith, provided they:

  • Report findings privately via the email address above before any public disclosure.
  • Avoid accessing, modifying, or deleting data that does not belong to them.
  • Do not disrupt the availability of the service for other users.
  • Act in good faith to avoid privacy violations and user harm.

Bug Bounty

CraftLingua does not currently operate a paid bug bounty program. We are a small independent product and cannot offer monetary rewards, but we sincerely appreciate responsible disclosures and will credit researchers publicly (with their consent) upon resolution.

Contact

Security reports: security@craftlingua.app

General enquiries: contact@craftlingua.app