# Security & Responsible Disclosure
Last updated: 2026-08-18
We take the security of Queen seriously. If you've discovered a vulnerability, we'd love to hear from you.
## Reporting a Vulnerability
Email: security@thequeen.app
When reporting, please include:
- A clear description of the issue
- Steps to reproduce
- Potential impact
- Any proof-of-concept code (please don't share publicly)
We commit to:
- Acknowledging your report within 48 hours
- Providing a status update within 7 days
- Crediting you (if you wish) in our security hall of fame after a fix ships
## Safe Harbor
If you act in good faith, follow this policy, and do not:
- Access, modify, or destroy data you don't own
- Disrupt the Service or other users
- Engage in social engineering
- Publicly disclose the issue before we've had a chance to fix it
…we will not pursue legal action against you for your research.
## Out of Scope
The following are generally NOT in scope:
- Reports from automated scanners without manual verification
- Missing security headers without exploitable impact
- Self-XSS, clickjacking on pages without sensitive actions
- Rate-limiting issues with no privacy/security impact
- Denial of Service attacks
- Social engineering of staff
- Physical attacks
## Architecture Highlights
- HTTPS everywhere (TLS 1.3)
- Encryption at rest (AES-256, Supabase)
- Row Level Security on all user-data tables (
auth.uid() = user_id) - Application-layer user_id filtering on every query
- Rate limiting + abuse detection on public APIs
- Daily encrypted backups, point-in-time recovery
- Audit logging on all AI assistant actions
## security.txt
The machine-readable version of this policy is at:
## PGP Key
(Coming soon)