Skip to content
Starfield Labs
Theme

Security

Safe by design. Tell us if it isn't.

How we protect Starfield Labs, how to report a security issue, what we ask of you while you test, and what you can expect from us.

01 / How we protect it

Built to keep your account and your work safe.

What Starfield Labs does today, in plain words.

Encrypted in transit

Every connection uses TLS 1.2 or newer, from your browser through Cloudflare to our servers, and our database takes encrypted connections only.

No passwords to steal

You sign in with an emailed code, GitHub, or Google. We never store a password, and we keep only a hash of each session, so even a copy of our database can't sign anyone in.

A fresh sign-in for big changes

Adding or removing a sign-in method, or deleting your account, needs a sign-in from the last 10 minutes. Signing out ends that session at once.

Agents get only what you allow

An agent connects through OAuth: you approve it on a consent screen, it gets only the access it asked for, and its access tokens last five minutes.

Uploads and links are checked

Images are checked against their type and saved again without hidden metadata, such as where a photo was taken. Links on profiles are checked against Google Web Risk.

Hosted in the EU

Starfield Labs runs on Google Cloud in Belgium, behind Cloudflare, with daily database backups and secrets kept in Google Secret Manager.

Checked as it's built

Our checks scan the code for leaked secrets and for dependencies with known vulnerabilities, and a dependency can't run its own install scripts unless we allow it.

02 / What to send

Give us enough to see it for ourselves.

  1. Where it is: the page, the API call, or the MCP tool, and the account you were signed in as.
  2. The steps, in order, with any request or payload you sent.
  3. What an attacker could do with it: the impact, not only what you saw.
  4. Anything we need to reproduce it safely, such as a test account you made.

Please keep it out of Discord, GitHub, and anywhere else public until it is fixed.

03 / Ground rules

Test without hurting anyone.

Use only your own accounts

Never open, change, or keep someone else's data. Stop once you have shown the issue is real; you don't need to show how far it goes. If you see personal data by accident, say so in your report and delete it.

Keep the service up

No denial of service, load tests, or scans heavy enough to slow it for others. No phishing or social engineering of our staff, our community, or our vendors, and no attacks on services we only use.

Your agent follows the same rules

If you test through the MCP server, point your agent at your own account only, and keep its request rate modest.

04 / What we promise

We'll work with you, not against you.

  • We reply within 5 working days, and tell you when a valid report is fixed.
  • We'll agree on timing with you if you want to write about it once it is fixed.
  • If you'd like, we'll thank you by name once the fix ships.

Safe harbor

If you research our security in good faith and follow this policy, we will consider your research authorized. We will not take legal action against you, or ask anyone else to, including under computer misuse laws such as the US Computer Fraud and Abuse Act, the UK Computer Misuse Act, or similar laws, or for breaking our terms in ways the research needed. If someone else takes legal action against you over research that followed this policy, we will make it known that your research was authorized.

Good faith means you: stay within the rules on this page; use only your own accounts, or accounts you have permission to use; stop and tell us as soon as you reach data that is not yours, and do not keep or share it; do not harm the service or its members, for example by denial of service, spam, or social engineering; and give us reasonable time to fix a problem before you tell anyone else about it.

This promise covers only Starfield. It cannot authorize research on services we do not own, such as Google Cloud, Cloudflare, or GitHub. If you are unsure whether something is covered, ask us at support@starfield.net before you go further.

We may not reply in detail to a report that is out of scope, can't be reproduced, or is already known.

05 / No bounty

We don't pay for reports.

Starfield Labs runs no bug bounty. We pay nothing for security reports, including the ones we fix, and we don't negotiate payment after a report arrives. Sending one creates no claim to a reward. What you get from us is a fix, and our thanks.

06 / Out of scope

What we're unlikely to act on.

A report that holds only these may get no reply:

  • A scanner's output with no impact shown.
  • Missing headers, cookie flags, or TLS preferences, without a working exploit.
  • SPF, DKIM, or DMARC observations, and spoofed mail our provider already stops.
  • Self XSS, or anything that needs the victim to paste an attacker's code into their own browser.
  • Clickjacking on a page with no action to take, and rate limits on public pages that only read.
  • Version numbers, banners, and listings that show nothing private.
  • Flaws in services we don't run; please tell their owners.
  • Anything that needs a rooted device, a malicious browser extension, or an account already taken over.