Security

Report a vulnerability

Email tom@p10q.com. Include the affected Cairn version, macOS or iOS version, impact, reproduction steps, and any safe proof of concept.

Do not send private keys, access tokens, customer data, complete license keys, or unrelated terminal contents. Ask for an encrypted channel before sharing sensitive material.

Response

p10q aims to acknowledge a security report within two business days. The time needed to investigate and fix an issue depends on its severity and complexity. p10q will provide status updates when practical and coordinate a reasonable disclosure date with the reporter.

Good-faith research

Use only accounts, devices, licenses, and data that you own or are authorized to test. Avoid privacy violations, data destruction, service disruption, social engineering, denial-of-service testing, and access to another person's systems. Stop testing and report the issue if you encounter customer data or gain unintended access.

Architecture notes

• Cairn stores license and validation state in the macOS Keychain.
• Remote access uses infrastructure in the user's AWS account and SSH with pinned host keys.
• p10q does not operate a relay that receives terminal traffic.
• Release builds and updates are signed; public macOS releases are notarized by Apple.

Not a bug bounty

p10q does not currently offer a paid bug-bounty program. This page does not authorize testing that would otherwise be unlawful or violate a third party's terms.