Security Policy

TraceGist records browser sessions — console logs, network traffic, screenshots, video, voice. Its entire value rests on handling that data safely, so security reports are taken seriously and handled with priority.

Scope

This policy covers:

• the TraceGist browser extension (distributed as a zip via https://tracegist.com)
• the MCP bridge (tracegist-mcp-bridge on npm)
• the relay (tracegist-relay on npm, and the deployment at relay.tracegist.com)
• the website (https://tracegist.com)

Especially interesting: anything that breaks the redaction of sensitive data on an egress path (exports, live streaming, AI calls), the end-to-end encryption of Remote Live Sessions, or the zero-knowledge property of the relay.

How to report

Email hello@tracegist.com with SECURITY in the subject line. Please include:

• what you found and where (component, version)
• steps to reproduce, a proof of concept, or the affected code path
• your assessment of the impact
• how you would like to be credited, if at all

Please report privately by email first — not in a public issue, social post, or third-party disclosure platform.

This policy is published at https://tracegist.com/security; a machine-readable security contact is at https://tracegist.com/.well-known/security.txt (RFC 9116).

What to expect

• Acknowledgement within 3 business days.
• Initial assessment (accepted / declined / need more info) within 7 days of acknowledgement.
• A remediation plan and timeline for accepted reports, and updates when the status changes.
• Credit in the release notes for the fix, if you want it. There is currently no bug bounty.

We ask that you give us 90 days from the report before disclosing publicly, and that you coordinate the disclosure date with us. We will not ask you to keep an issue secret indefinitely.

Safe harbor

Good-faith security research within this policy will not be met with legal action, and we will not report it to authorities. Good faith means:

• do not access, modify, or delete data that is not yours — recorded sessions can contain highly sensitive third-party data; use your own test recordings
• no denial-of-service or resource-exhaustion testing against relay.tracegist.com or tracegist.com
• no social engineering, phishing, or physical attacks
• stop and report as soon as you can demonstrate the issue

Supported versions

Only the latest released version of each component receives security fixes:

• Extension: the current zip at https://tracegist.com/install
• Bridge / relay: the latest version on npm

The extension has no auto-update mechanism. Security releases are announced through the update list (subscribe at https://tracegist.com/install) and in the release notes — that list is the way to learn that a fixed version exists.

Software bill of materials

A CycloneDX SBOM for each shipped component is published at https://tracegist.com/sbom (source: the sbom/ directory of the repository, regenerated on every release via npm run sbom). The extension download also ships THIRD-PARTY-NOTICES.txt with the license texts of bundled components.