Security

1. Overview

ShadeGPT is built for security research and analysis, so protecting accounts, conversations, uploaded files, generated artifacts, and tool execution is part of the core service design. This page summarizes the security practices we apply today and how to report potential vulnerabilities.

2. Data in Transit

Connections between your browser and ShadeGPT are encrypted in transit using HTTPS/TLS. We also apply security headers such as content security policy, frame restrictions, content-type protection, referrer policy, and limited browser permissions.

3. Accounts and Access

ShadeGPT supports email/password sign-in and third-party authentication providers. Account sessions are protected with secure session handling, and sensitive application routes require an authenticated account. Administrative capabilities are restricted by role and are separated from normal user access.

4. Conversations, Files, and Sandboxes

Chat history is saved to your account so you can return to prior work. Uploaded files are scoped to the conversation where they were uploaded and are not accessible to other users. Code and script execution runs in isolated sandbox containers separated by user and conversation.

We do not sell your personal data, and we do not use your conversations or uploaded content to train AI models. For more detail on data collection, use, sharing, retention, and deletion requests, see our Privacy Policy.

5. Abuse Prevention

ShadeGPT includes rate limiting, request logging, file validation, outbound URL checks, tool restrictions, sandbox controls, and abuse monitoring to protect the Service and other users. Security and reconnaissance tools may only be used on systems, accounts, files, and data you own or are explicitly authorized to test. See our Acceptable Use Policy for the full rules.

6. Vulnerability Disclosure

If you believe you have found a security vulnerability in ShadeGPT, please report it to abuse@mail.shadegpt.app. Include enough detail for us to understand and reproduce the issue, such as affected URLs, account identifiers, timestamps, browser or client details, steps to reproduce, screenshots, logs, and the potential impact.

We will review reports in good faith and may contact you for additional information. Please do not publicly disclose a vulnerability before we have had a reasonable opportunity to investigate and address it.

7. Responsible Testing

When testing ShadeGPT, you must not:

• Test against accounts, conversations, files, systems, or data you do not own or have permission to access
• Access, modify, delete, or exfiltrate another user's data
• Disrupt, degrade, overload, or deny service to ShadeGPT or its users
• Attempt social engineering, phishing, spam, physical attacks, or attacks against employees or users
• Bypass rate limits, abuse controls, sandbox controls, or access restrictions beyond what is necessary to demonstrate a vulnerability safely
• Use automated scanners in a way that creates excessive traffic, alerts, or operational risk

These rules supplement our Terms of Service and Acceptable Use Policy.