Security & vulnerability disclosure

ARCNM prices your parts from your CAD files, so the platform holds customer geometry, prices and credentials. If you believe you have found a vulnerability, we want to hear about it — privately, and before anyone else does.

How to report

• Email [email protected]. Encrypted mail is welcome; ask for a key in your first message if you need one.
• The same contact is published machine-readably at /.well-known/security.txt (RFC 9116), together with the file's expiry and this policy.

Please do not file a public ticket, post in a forum, or describe the issue on social media until a fix is released.

What to include

• The affected endpoint, page or feature — for the API, the method and path; for the web app, the URL.
• Steps to reproduce, ideally a minimal request or script, with any X-Request-ID values from the responses you saw.
• The impact you believe an attacker could achieve.
• Whether you accessed, changed or retained any data that is not yours. Please stop at the proof and do not go further.

What we do

1. We acknowledge the report and start investigating.
2. We keep you informed while we reproduce, fix and verify the issue.
3. We coordinate the disclosure with you once a fix is live, and we credit you if you want to be credited.

Testing against accounts and data you own is fine. Please do not test against other customers' tenants, run denial-of-service traffic, or use automated scanners at a rate that degrades the service for others.

Scope

In scope: arcnm.io, api.arcnm.io (REST and the MCP server at /mcp-server/mcp), the web application, and the official SDKs and documentation.

Out of scope: third-party services we rely on (report those to their owners), and findings that need physical access to a user's device.

Keeping the platform patched

Dependencies are pinned and updated continuously; security fixes ship in the next deploy after they are verified. The current API version and the change history are in the changelog.