⚡ Sangsakala Proxy 🏠 Home
Skip to content

Repository navigation

Security: parsehook/parsehook

Security

Report a vulnerability

SECURITY.md

Security Policy

ParseHook takes the security of our platform and your data seriously. This document describes how to report security vulnerabilities and what you can expect from us.

Scope

Security issues in the following areas are considered in scope:

  • Webhook signature verification
  • API authentication and authorization
  • Email parsing pipeline
  • Dashboard and user account security
  • Data handling and privacy controls

This repository contains documentation and integration examples only. The production application code is not hosted here.

Reporting a Vulnerability

If you believe you have found a security vulnerability, please report it privately.

Contact: security@parsehook.com

Please include:

  • A clear description of the issue
  • Steps to reproduce
  • Affected endpoint, page, or component
  • Potential impact
  • Your contact information

Do not open a public GitHub issue for security vulnerabilities. Do not include sensitive payloads, personal data, or production data in your report.

What to Expect

  • We aim to acknowledge your report within 3 business days.
  • We will provide an initial assessment within 7 business days.
  • You will receive updates as we investigate and remediate.
  • If the vulnerability is accepted, we will confirm the fix and may credit you in our security acknowledgments.
  • If the vulnerability is declined, we will explain why.

Responsible Disclosure

We ask that you:

  • Do not exploit the vulnerability beyond what is necessary to demonstrate it.
  • Do not access, modify, or delete data that does not belong to you.
  • Do not disclose the vulnerability publicly until we have confirmed a fix.
  • Give us a reasonable time frame to respond before any public disclosure.

Security Practices

  • All webhook payloads are signed with HMAC-SHA256.
  • Data in transit is encrypted using TLS 1.3.
  • Data at rest is encrypted using AES-256.
  • Authentication uses JWT tokens with Row Level Security.
  • Email payloads are processed in volatile memory and not used for AI training.
  • Infrastructure is hosted in Germany (EU) and operated in compliance with GDPR.

Preferred Languages

Reports can be submitted in English or German.

Hall of Fame

We appreciate security researchers who help us improve ParseHook. With your permission, we may add your name to our Security Hall of Fame.

There aren't any published security advisories