Security

How to report

Send your report to myer@getorigami.io, with “Security” in the subject or topic. Please include:

• What the issue is and where it is (a URL, endpoint or app id).
• Steps to reproduce it, and what an attacker could do with it.
• How to reach you for follow-up questions.

What we commit to

• We'll acknowledge your report within three working days.
• We'll keep you updated while we investigate and fix it, and tell you when it's resolved.
• We won't take legal action against research done in good faith under this policy.
• With your permission, we'll credit you once the fix is live.

Scope

In scope: this website, the Origami API and the MCP app endpoints (/mcp/…).

Out of scope: denial of service, spam or social engineering, physical attacks, and issues in third-party services or in the websites of companies we read. Please don't access, change or delete data that isn't yours; use test data where you can.

Rewards

We don't run a paid bug bounty yet. We're grateful for every report and will say thank you properly.

More about how we work

See our Trust page for what we crawl, what we store and how long we keep it. A machine-readable version of this policy is at /.well-known/security.txt.