The short version
Email security@just-done.ai with the details. We aim to acknowledge within 2 business days and to triage within 5. Don’t publish or exploit the issue until we’ve had a chance to fix it. We do not intend to pursue legal action against good-faith research that follows this policy, subject to applicable law.
This policy is also machine-readable at /.well-known/security.txt per RFC 9116.
1.Reporting a Vulnerability
If you believe you’ve found a security vulnerability in any Just Domain service (the marketing site at justdomain.ai, the checkout flow, the MCP server at mcp.justdomain.ai used by ChatGPT, Claude, and other AI assistants, or the webhook handler), please email security@just-done.ai with:
- A clear description of the issue and where it lives.
- Step-by-step reproduction instructions, ideally with a minimal proof of concept.
- The impact you can see (what an attacker could do, who is affected).
- Your name or handle if you’d like to be credited.
Encrypted reports are welcome. Drop us a line at the address above and we can arrange a key exchange.
2.Scope
The following hosts are in scope:
- justdomain.ai and any sub-route (marketing, checkout, account, dashboard).
- sandbox.justdomain.ai: the staging mirror.
- mcp.justdomain.ai and sandbox-mcp.justdomain.ai: the MCP server consumed by AI assistants.
- webhooks.justdomain.ai and sandbox-webhooks.justdomain.ai: the Stripe webhook surface.
3.Out of Scope
We appreciate the effort, but the following classes of report are unlikely to result in a fix:
- Missing security headers without a demonstrable impact (e.g.
X-Content-Type-Options,Referrer-Policywithout an exploit path). - Reports generated solely by automated scanners with no manual verification.
- Self-XSS, clickjacking on pages with no sensitive state changes, or rate-limit bypasses on non-authentication endpoints.
- Vulnerabilities in third-party services we depend on (Stripe, Openprovider, Vercel, Railway, WorkOS). Please report those directly to the vendor.
- Outdated software versions without a working exploit specific to our deployment.
- Social engineering of our team or contractors, physical attacks, and any testing that involves a real third party.
4.Our Response
These are the response targets we aim for once we receive a valid report. They are goals we work to, not guarantees:
- Within 2 business days: acknowledge receipt and assign a tracking handle.
- Within 5 business days: an initial triage assessment with a severity rating and our planned next steps.
- Continuous: updates as we make progress on the fix, until resolution.
- After deploy: a final note confirming the fix and any follow-up monitoring.
5.Coordinated Disclosure
We ask that you give us a reasonable opportunity to fix a reported issue before you publish it. Our disclosure window is typically 90 days from initial report.
If you believe an issue is being actively exploited or affects a meaningful number of users in real time, contact us immediately at the address above and we prioritise it.
6.Safe Harbor
“Good faith” means: you make a sincere effort to avoid privacy violations, data destruction, service degradation, or harm to our users; you only interact with accounts you own or have explicit permission to test; you stop and report as soon as you understand a vulnerability; and you do not exfiltrate more data than is needed to demonstrate the issue.
This safe harbor applies to our services only. It does not authorize you to act in a way that violates the policies of our vendors or any third-party services.
7.Recognition
Just Domain is an indie operation. We don’t (yet) run a paid bug bounty. We may, however, credit researchers who help us stay safe. If you would like to be credited publicly, say so in your report and include the name or handle you would like us to use.
8.Contact
Primary: security@just-done.ai
General privacy questions: privacy@just-done.ai
Machine-readable policy: /.well-known/security.txt