Security

Last updated: April 20, 2026

We take security seriously. If you discover a vulnerability in Canopy, please report it responsibly so we can fix it before it affects users.

Responsible Disclosure

Please report security vulnerabilities by email to [email protected]. Do not open a public GitHub issue for security-sensitive findings.

We follow coordinated disclosure. We ask that you give us reasonable time to investigate and patch before publishing details publicly. We will acknowledge your report within one business day and keep you updated throughout the process.

A PGP public key for encrypted reports is planned and will appear here once available. In the meantime, standard email is acceptable — we monitor this address continuously.

Scope

The following are in scope for vulnerability reports:

• License webhook Worker — heartbeat.canopy.ironpinelabs.com. Authentication bypass, license spoofing, seat limit circumvention.
• Admin portal Worker — admin.canopy.ironpinelabs.com. Auth bypass, unauthorized binding revocation, data exposure.
• CLI binary — canopy. Local privilege escalation, license validation bypass, unsafe file handling.
• Indexing and MCP server — canopy serve. Path traversal in tool handlers, command injection via indexed content, unsafe deserialization.
• License key format — Ed25519 signature forgery, payload tampering.

Out of Scope

• Vulnerabilities requiring physical access to the user's machine.
• Reports that amount to "the binary reads files from disk" — this is expected behavior.
• Findings against third-party services (Stripe, Cloudflare, Resend) — report those to the respective vendor.
• Internal infrastructure not reachable from the public internet.
• Social engineering attacks targeting Ironpine Labs staff.
• Denial-of-service attacks that require the attacker to already control the local machine.