Security

1. Reporting a Vulnerability

If you believe you've found a security vulnerability in Specor — the web app (app.specor.ai), the API (api.specor.ai), the Specor Figma plugin, or the MCP server — please report it to security@specor.ai. Include:

• A description of the issue and its potential impact.
• Steps to reproduce (a proof of concept, if you have one).
• The affected URL, endpoint, or component.

We aim to acknowledge new reports within 3 business days and to share a remediation timeline once we've confirmed the issue. We'll keep you updated as we work on a fix, and we're happy to credit you (with your permission) once it's resolved.

2. Safe Harbor

We consider security research conducted under this policy to be authorized. We will not pursue legal action against you for good-faith testing that follows these rules:

• Only test against your own account and data — never access, modify, or exfiltrate another user's or organization's data.
• Don't run automated scans or tests that could degrade the service for other users (no denial-of-service testing).
• Don't use social engineering, phishing, or physical-access attacks against Specor staff or customers.
• Report privately to security@specor.ai first, and give us a reasonable window to fix the issue before any public disclosure.
• Stop testing and notify us immediately if you encounter data that isn't yours.

3. Scope

In scope:

• app.specor.ai (the Specor web application)
• api.specor.ai (the Specor API)
• The Specor Figma plugin
• The Specor MCP server

Out of scope:

• Third-party services we integrate with (e.g. Stripe, our email provider) — please report those directly to the vendor.
• Social engineering or physical-security testing against Specor staff, offices, or customers.
• Denial-of-service, spam, or volumetric testing.

4. What We Do to Prevent Issues

Security is enforced throughout the platform, not bolted on after the fact:

• Row-level workspace isolation and role-based access control (viewer/editor/admin at the workspace level, member/admin/owner at the org level), enforced server-side on every request — never left to the client.
• Automated dependency vulnerability scanning (pip-audit, npm audit) on every change and on a weekly schedule.
• Static analysis (Bandit, Semgrep with OWASP Top 10 rulesets) and infrastructure misconfiguration scanning (Trivy) in CI.
• Secret scanning (Gitleaks) to catch credentials before they're committed.
• Dynamic testing (OWASP ZAP) against the running API for runtime issues like injection and missing security headers.
• Secrets and API keys are never logged, returned in responses, or stored in plaintext.

We are not currently certified under a formal framework such as SOC 2 or ISO 27001. If that's a requirement for your organization, contact security@specor.ai — we're glad to discuss it.

5. Reporting a Data Breach

If you suspect unauthorized access to your account or Specor data, contact security@specor.ai immediately. See our Privacy Policy for how we handle and notify affected users of confirmed data breaches.