Reporting security vulnerabilities
Found a security issue in Shoji Flow? Thank you for telling us first — here is how.
This English version is a courtesy translation. The legally binding version is the German version.
How to report
Please e-mail office@7thlayer.ventures with the subject line “Security”. Helpful details: the affected component and version, steps to reproduce, and your assessment of the impact. Please report privately by e-mail first — not in public forums or trackers.
A machine-readable version of this contact information is published at /.well-known/security.txt (RFC 9116).
Scope
- The Shoji Flow desktop app for Windows (including its local AI components)
- The Shoji Flow companion browser extension
- This website (shojiflow.com)
Issues in the Steam platform itself belong to Valve’s own security process; issues in third-party services we merely link to belong to the respective provider.
What you can expect from us
- We confirm receipt of your report within three business days.
- We keep you informed about our assessment and the progress of a fix.
- We follow coordinated disclosure: please give us a reasonable window (customarily 90 days) to ship a fix before publishing details. We are happy to credit you when the issue is disclosed, if you wish.
- We do not operate a paid bug-bounty program.
Good-faith research
We will not initiate legal action over security research conducted in good faith that stays within the scope above, avoids privacy violations and data destruction, does not degrade the service for others, and gives us the opportunity to fix the issue before public disclosure.
Security updates
Security updates for the Shoji Flow desktop app are delivered free of charge through Steam’s regular update mechanism, for at least five years from the product’s release. Updates for the companion browser extension are delivered through the respective browser extension stores.