Security Disclosure

Last updated: 2026-05-05

Pidgin appreciates security researchers who help us keep our users safe. This page describes our coordinated disclosure process.

Scope

In scope:

• pidgin.sh and all subdomains (*.pidgin.sh)
• api.pidgin.sh
• The pidgin-share Claude Code skill
• The Pidgin API

Out of scope:

• GitHub, Cloudflare, Stripe, and any other third-party service Pidgin uses
• Findings already public or reported by another researcher
• Theoretical issues without a working proof of concept
• Volumetric attacks (DoS, DDoS) — please don't
• Social engineering of Pidgin's operator
• Issues that require physical access to a device

Reporting

Email security@pidgin.sh with:

• A clear description of the vulnerability
• Steps to reproduce
• Impact assessment
• Your name (optional, for credit)

We aspire to acknowledge reports within 7 days and will keep you updated as we work on a fix.

Safe harbor

If you act in good faith, comply with this policy, and avoid privacy violations and service disruption, Pidgin will not pursue legal action against you for your research. We will work with you to understand the issue and resolve it.

No bug bounty

Pidgin does not currently offer monetary rewards. We will credit researchers who help us fix issues, with their permission.