A security tool has to hold itself to the standard it applies to everyone else. If you find a vulnerability in the SixthWall CLI, MCP server, this website, or any published package, we want to hear about it privately first.
How to report
Use GitHub's private vulnerability reporting on the repository's security page. Include what you found, how to reproduce it, and what you think the impact is. You do not need a proof-of-concept exploit; a clear description is enough.
What we promise
- An acknowledgement within three working days.
- A fix or a clear plan within thirty days for anything confirmed, faster for anything serious.
- Credit in the changelog if you want it, or none if you prefer.
- No legal action against good-faith research that stays within the scope below.
Scope
In scope: the published npm packages, the code in the repository, and sixthwall.dev. Out of scope: denial of service, findings that require a compromised machine, and third-party services we do not operate.
How the scanner handles your code
The CLI and MCP server read files from the folder you point them at and write results to the terminal and to .sixthwall/ inside that folder. They make no network requests during a scan. The only network activity is npm downloading the package. There is no telemetry.