Report a vulnerability
Email aditya.official824@gmail.com. Please include:
- Steps to reproduce, with the requests or code you used.
- The affected URL, endpoint or component, and its version if it's the npm package or the Figma plugin.
- What an attacker could do with it.
We acknowledge reports within 3 business days and keep you updated until the issue is fixed. Please give us a reasonable time to fix it before you disclose it publicly.
Rules and safe harbor
- Test with your own GitHub account and your own repositories.
- Don't access, change or delete other people's data. If you reach some by accident, stop, don't keep it, and tell us.
- Don't degrade the service for anyone else.
If you research in good faith, within the scope below and these rules, we consider it authorized and won't take legal action against you.
In scope
- paritrix.com and its API, including the connector at paritrix.com/api/mcp and its sign-in.
- The Paritrix GitHub App: scans, pull request comments and fix pull requests.
- The Paritrix Figma plugin.
- The npm package @paritrix/mcp (the local connector).
Out of scope
- Denial of service and volume or load testing.
- Social engineering, phishing and physical attacks.
- The third-party services Paritrix uses (GitHub, Figma, Vercel, Supabase, Slack, Anthropic): report to them directly.
- Missing best-practice headers or settings without a demonstrated impact.
How Paritrix protects your data
- Reads, doesn't push. Paritrix reads your repositories and comments on pull requests. It opens a pull request only when someone asks for one (or turns on automatic fixes in the repo's config), and never pushes to existing branches.
- Never runs your code. Paritrix doesn't build or run your repository. Visual checks render the Storybook you already deployed, in a separate service that has none of Paritrix's keys.
- Tokens stored only as hashes. API tokens and connected apps' access is stored as one-way hashes; we can't read them back.
- Secrets encrypted. Figma tokens and Slack webhook URLs are encrypted with AES-256-GCM.
- HTTPS only. Every request is encrypted in transit.
- Rate limits on sign-in, the API, the connector and heavy actions such as scans and visual checks.
- Access re-checked against GitHub. Your repositories are refreshed from GitHub while you use Paritrix, and API tokens and connected apps re-check access too: lose access on GitHub and you lose it in Paritrix within 15 minutes.
What Paritrix stores and who processes it: Privacy policy.