FileRouter handles customer documents and credentials. Please report suspected security issues privately so we can investigate them before public disclosure.

Email hello@thinkex.app with the subject FileRouter security report.

Please include:

• The affected URL, API route, package, or version.
• Reproduction steps or a minimal proof of concept.
• The impact you believe is possible.
• Any relevant request IDs, timestamps, logs, screenshots, or configuration.
• How we can contact you for follow-up.

Do not include customer documents, credentials, API keys, access tokens, or other people's personal data in a report. Use synthetic data wherever possible.

Please do not open a public GitHub issue for an unpatched vulnerability. We ask that you give us a reasonable opportunity to investigate and remediate a report before publishing details.

Good-faith research should:

• Use accounts and data you own or have explicit permission to test.
• Avoid privacy violations, service disruption, denial of service, spam, and social engineering.
• Stop testing and report the issue if you encounter another person's data.
• Avoid persistence, destructive actions, and accessing more data than needed to demonstrate the issue.

We will not pursue legal action against good-faith research that follows these guidelines. This policy does not authorize testing against third-party services or infrastructure used by FileRouter.

Security fixes are applied to the hosted service and the latest published versions of FileRouter packages. Users should upgrade to the latest available package version before reporting an issue that may already have been fixed.