Security

Last updated: 12 October 2026

What this is about

This policy describes how to report a vulnerability in DuctTape.io and how we handle it. DuctTape.io is operated by Mario Fraiß-Kollmanitsch; the address is in the imprint. We welcome every report that makes DuctTape.io safer.

What you can report

• the web app at theducttape.io, including public diagram links and embedded diagrams
• the MCP endpoint at theducttape.io/api/mcp
• the Claude skill as offered on github.com/DuctTape-io/ducttape-skill and at /claude-skill

Please report vulnerabilities in services we use (such as sign-in, hosting or e-mail delivery) directly to that provider. If one affects DuctTape.io, let us know as well.

How to report

Write to security@theducttape.io, in English or German. Helpful details:

• what is affected (address, MCP tool or file in the skill)
• the steps that let us reproduce the vulnerability
• what an attacker could achieve with it
• how to reach you, and whether you would like to be credited

Do not send us other people's data. If you saw such data by accident, only describe that it happened and how.

What you can expect from us

• A first answer within 3 working days.
• Our assessment of whether we can reproduce the vulnerability, and the next steps.
• A message once it is fixed.

Please do not publish anything before the vulnerability is fixed or 90 days have passed since your report. If we need longer, we will agree on it with you. We meet legal reporting duties, for example to authorities, regardless of this.

Good-faith research

If you follow this policy, we consider your research to be in good faith and will not take legal action against you because of it. If someone else asks, such as a provider whose service we use or an authority, we will confirm on your request that you acted within this policy. We cannot give permission for other providers' services.

This means:

• You test only with your own accounts and diagrams.
• You do not access, change or delete other people's data. If you come across it anyway, you stop there and report it to us.
• You do not disrupt the service: no overloading (DoS), no mass automated requests.
• No social engineering, no phishing and no physical attacks, neither against us nor against users of DuctTape.io.
• You do not exploit a vulnerability further than needed to demonstrate it.

Rewards

We do not pay rewards. If you like, we credit you on this page as a thank-you once the vulnerability is fixed.