We take the security of GaiaDesk and everyone who relies on it seriously. GaiaDesk gives remote access to computers, so we treat every report as urgent.

Please do not open a public issue, discussion or pull request for a security problem.

Email security@gaiadesk.net with:

• what you found and where (app, platform and version, SDK, MCP server, website or API);
• the steps to reproduce it, and what an attacker could do with it;
• any proof of concept, logs or screenshots;
• whether and how you'd like to be credited.

You can also use GitHub's private vulnerability reporting on any of our public repositories.

• We acknowledge your report within 2 business days.
• We send an initial assessment within 5 business days.
• We keep you updated until it's fixed, and agree a disclosure date with you. We aim to ship fixes for critical issues within 14 days.
• We credit you in the release notes if you'd like.

In scope: the GaiaDesk desktop, mobile and QuickSupport apps, the signaling and relay servers, gaiadesk.net and its API, and the SDKs and MCP server in this organization.

Please don't: access or change data that isn't yours, degrade the service for others (no denial of service), run social engineering or phishing against our staff or users, or test against other people's computers. Good-faith research that follows these rules won't face legal action from us.

Security fixes go into the latest release. The apps update themselves; please keep automatic updates on.