Security

Last updated: October 24, 2026

If you think you have found a security problem in Podshare, please tell us. We read every report, and we would rather hear about a problem from you than from anyone else.

How to report

Email support@podshare.ai with "Security report" in the subject. Include:

• What the problem is, and what someone could do with it
• The steps to show it, with the addresses, accounts, and pods you used
• Screenshots or a short recording, if you have them
• How you would like to be credited, if at all

Please keep the details private until we have fixed it, and give us a reasonable time to do so.

What happens next

• We reply within 3 business days to say we have your report.
• Within 10 business days we tell you what we found and what we plan to do.
• We fix serious problems as fast as we can, and keep you told until it is done.
• With your permission, we credit you when the fix is out.

We do not pay rewards for reports at this time.

Testing in good faith

We will not take legal action against you, or ask anyone else to, for research that follows these rules. If someone else does, we will make clear that your research was allowed.

• Test only with accounts and pods that are yours, or that you have permission to use.
• Stop as soon as you reach anyone else's data. Look at no more than you need to show the problem, keep none of it, and tell us what you saw.
• Do not slow down or interrupt Podshare for other people: no denial of service and no flooding.
• Do not try to trick, phish, or pressure our staff or other people who use Podshare.
• Do not use a problem for anything beyond showing it to us.

In scope

• podshare.ai, the website and the app
• mcp.podshare.ai, the service that AI apps connect to
• podshare.site and pslink.io, where artifacts are published and shared

Not in scope

• Scripts running inside an artifact. Artifacts are pages and small apps that people build, and they run their own scripts by design, in a sandbox apart from Podshare. A way out of that sandbox is in scope.
• Harmful or deceptive content in a published artifact. Please use Report instead.
• Reports from automated scanners with no way to show harm
• Missing headers or settings that cannot be used to do harm on their own
• Rate limits, or forms that can be sent many times
• Problems in the services we use, such as our sign-in or hosting providers. Please report those to them.

This policy is also at /.well-known/security.txt. For anything that is not a security problem, see Support.