Vulnerability Disclosure

Last updated: October 26, 2026

If you think you've found a security vulnerability in Tempr, please tell us. We read every report, and we'd rather hear about a problem from you than find it in our logs.

1. How to report

Email security@temprhq.io. Please include:

• what you found, and where (the address, the client and its version, or the API endpoint);
• the steps to reproduce it;
• what an attacker could do with it, as far as you know.

Screenshots, a short video or a proof of concept help. Please don't put another customer's data in a report; describe it instead. Our machine-readable contact is at /.well-known/security.txt on temprhq.io, portal.temprhq.io and api.temprhq.io.

2. What we commit to

• We'll acknowledge your report within 3 business days.
• We'll tell you whether we can reproduce it, and keep you updated until it's fixed.
• We'll tell you when it's fixed, and credit you on request.
• If a vulnerability affected customers' data, we'll tell the customers affected.

We don't run a paid bug bounty at the moment.

3. Scope

In scope:

• temprhq.io, portal.temprhq.io and api.temprhq.io;
• the Tempr Gateway, including its MCP relay and connectors;
• Tempr's clients: the VS Code, JetBrains and Visual Studio extensions, and the tempr CLI.

Out of scope:

• services we use but don't run, such as AWS, Stripe, WorkOS and the AI providers (please report those to their owners);
• denial of service, load testing and spam;
• social engineering of our team, and physical attacks;
• automated scanner output, or missing best-practice headers, without a way to exploit it.

4. Rules for testing

• Test only with accounts and data you own. A free account is enough for most testing.
• Do only what you need to show the problem: don't pivot to other systems, keep access, or change anything you didn't create.
• If you reach data that isn't yours, stop, don't keep or share it, and tell us.
• Don't degrade the service for others: no denial of service, and keep automated testing to a gentle rate.
• Give us a reasonable time to fix the problem before you publish anything. We aim to fix serious issues within 90 days, and we'll agree a date with you.

5. Safe harbor

If you act in good faith and follow this policy, we consider your research authorized. We won't pursue or support legal action against you for it, and if someone else does, we'll make it known that you acted with our permission.

6. Contact

Security reports: security@temprhq.io. Anything else: contact@temprhq.io.