Security Policy

NoCapped, PBC takes the security of Pinxt and our supporting software seriously. This policy applies to every repository in the nocapped GitHub organization, including the Pinxt apps and backend, the c2pa_flutter, raw_import, and pinxt_image_engine plugins, and our websites.

Reporting a vulnerability

Please email security@nocapped.com. Do not open a public GitHub issue for security reports.

Include what you can of the following. Partial reports are welcome:

• The repository, app version or TestFlight/Play build number, or website affected
• Steps to reproduce, or a proof of concept
• The impact you believe it has
• How you would like to be credited, if at all

You will receive an acknowledgement within 3 business days and an initial assessment within 7 business days. We will keep you informed as we work on a fix and tell you when it has shipped.

Scope

In scope:

• The Pinxt iOS and Android apps and the Pinxt backend (AWS Amplify, AppSync, Lambda, S3, Cognito)
• Image processing and Content Credentials (C2PA) signing and verification. Anything that would let a manifest be forged, stripped without detection, or mis-attributed is treated as high severity
• The c2pa_flutter, raw_import, and pinxt_image_engine plugins
• pinxt.app, nocapped.com, and cms.nocapped.com

Out of scope:

• Findings that require a rooted or jailbroken device, or a modified app binary
• Denial of service, rate limiting, or volumetric attacks
• Reports from automated scanners without a demonstrated impact
• Vulnerabilities in third-party services we use (AWS, Google, Apple, Trufo, DigiCert). Please report those to the vendor
• Social engineering of NoCapped staff or Pinxt users

Rules of engagement

• Test only against accounts you own. Do not access, modify, or retain other users' data or photographs.
• Do not disrupt the service or degrade it for other users.
• Stop and report as soon as you have demonstrated a vulnerability; do not pivot further.
• Give us a reasonable time to fix the issue before any public disclosure. We ask for 90 days from acknowledgement, and will agree a date with you.

We will not pursue legal action against researchers who follow this policy in good faith, and we consider such research authorized under the relevant anti-hacking and anti-circumvention laws.

Supported versions

Security fixes are made on the main branch of each repository and shipped in the next app release or plugin tag. Only the latest release of each app and plugin is supported.

Our own practices

Dependency, code, and secret scanning run on every repository in this organization, with push protection enabled. Native image-decoding libraries used by the backend are rebuilt from upstream releases when security advisories are published. Private keys are never committed; development signing chains are generated per machine.

This policy is also published as security.txt (RFC 9116) on nocapped.com and pinxt.app.