Vulnerability disclosure policy
Updated 2026-10-30
Other language versions of this document with the same effect: 한국어. If they differ, the one more favourable to you applies. Reference translation: 日本語. If it differs, the English version prevails.
Cutaway Works, which operates ERDism, welcomes reports of security problems from anyone. This policy says what is in scope, how to look for problems without harming anyone, and what you can expect from us after you report.
Scope
- The website and service at erdism.com, including the app, the public docs, the demo and public project links.
- The ERDism programming interface that the app uses, under erdism.com/api.
Services run by other companies are not in scope, even when ERDism uses them, such as sign-in with Google or GitHub. Report problems in them to those companies.
What you may do
- Use your own accounts, workspaces and projects, or the demo, to test.
- Stop as soon as you have shown that a problem exists.
What you must not do
- Access, change or delete data that is not yours. If you reach someone else's data by accident, stop, do not keep a copy, and tell us in your report.
- Make the service slow or unavailable for others, including by sending large numbers of requests.
- Trick or pressure people, including our staff and our users, or try to get into our offices or equipment.
- Send spam or messages from ERDism to people who did not ask for them.
- Make the problem public before we have fixed it, or before 90 days have passed since your report, whichever comes first, unless we agree to another date.
How to report
Email [email protected]. Write in English or Korean if you can. Include:
- what the problem is and where it is (the address of the page or request);
- the steps to show it, and what you saw;
- what someone could do with it.
Do not include anyone else's personal data.
What happens next
- We will confirm that we received your report within 5 working days.
- We will tell you whether we can reproduce it and keep you informed while we fix it.
- When it is fixed, we will tell you, and, if you want, thank you by name in the release notes.
We do not pay rewards for reports.
Safe harbor
If you act in good faith and follow this policy, we will treat your research as authorised. We will not take legal action against you over it and will not ask the police to act against you. If someone else takes legal action against you over research that followed this policy, we will make it known that your research was authorised. This policy cannot authorise you to break laws that we do not control, and it does not cover services run by other companies.
If you are not sure whether something is allowed, ask us at [email protected] before you do it.