---
title: Security & vulnerability disclosure
description: How to report a security vulnerability in ARCNM privately, what a useful report includes, how we investigate and disclose it, and what is in scope for testing.
---

# Security & vulnerability disclosure

ARCNM prices your parts from your CAD files, so the platform holds
customer geometry, prices and credentials. If you believe you have found
a vulnerability, we want to hear about it — privately, and before anyone
else does.

## How to report

- Email **security@arcnm.io**. Encrypted mail is welcome; ask for a key
  in your first message if you need one.
- The same contact is published machine-readably at
  [`/.well-known/security.txt`](https://arcnm.io/.well-known/security.txt)
  (RFC 9116), together with the file's expiry and this policy.

Please do not file a public ticket, post in a forum, or describe the
issue on social media until a fix is released.

## What to include

- The affected endpoint, page or feature — for the API, the method and
  path; for the web app, the URL.
- Steps to reproduce, ideally a minimal request or script, with any
  `X-Request-ID` values from the responses you saw.
- The impact you believe an attacker could achieve.
- Whether you accessed, changed or retained any data that is not yours.
  Please stop at the proof and do not go further.

## What we do

1. We acknowledge the report and start investigating.
2. We keep you informed while we reproduce, fix and verify the issue.
3. We coordinate the disclosure with you once a fix is live, and we
   credit you if you want to be credited.

Testing against accounts and data you own is fine. Please do not test
against other customers' tenants, run denial-of-service traffic, or use
automated scanners at a rate that degrades the service for others.

## Scope

In scope: `arcnm.io`, `api.arcnm.io` (REST and the MCP server at
`/mcp-server/mcp`), the web application, and the official SDKs and
documentation.

Out of scope: third-party services we rely on (report those to their
owners), and findings that need physical access to a user's device.

## Keeping the platform patched

Dependencies are pinned and updated continuously; security fixes ship in
the next deploy after they are verified. The current API version and the
change history are in the [changelog](./changelog.md).