Vulnerability Disclosure Policy#

How to report a security vulnerability in TryFast, what is in scope, and how we protect researchers who act in good faith.

Last updated: 2026-10-24

subprocess.eu/company welcomes security research on TryFast. If you believe you have found a vulnerability, we want to hear from you.

Reporting#

• Email: security@tryfast.eu
• Machine-readable contact: /.well-known/security.txt
• Please include a description of the issue, steps to reproduce, the affected hosts, endpoints or script behavior, and your assessment of impact. Proof-of-concept code is appreciated. English or German is fine.

We aim to acknowledge reports within 3 business days and to give you an initial assessment within 10 business days.

Scope#

In scope:

• tryfast.eu, including the app (/app), the REST API (/api/v1), sign-in (/auth), the OAuth authorization server (/oauth, /.well-known) and the MCP server (/mcp)
• cdn.tryfast.eu: the per-project scripts, preview scripts, the visual editor and its API, and event collection
• mcp.tryfast.eu
• The TryFast script as it runs on a website, in particular anything that lets one workspace affect another workspace's data or website, or lets code escape the checks applied when it is saved
• Issues in our shared sign-in service accounts.login0.eu that affect TryFast

Out of scope:

• Websites of our customers that use TryFast; do not test them without their owner's permission
• Denial-of-service or volumetric testing, including flooding event collection
• Social engineering, phishing of our personnel, or physical attacks
• Our infrastructure providers (report Hetzner or AWS issues to them) and third-party services we merely link to
• Automated scanner reports without a demonstrated vulnerability
• SPF, DKIM or DMARC configuration reports without a demonstrated spoofing impact

Rules of engagement#

• Use your own workspaces. You can create one without an account at https://tryfast.eu/app/zero-account-setup, and test the script on a website you control.
• Do not access, modify or delete data that is not your own. Stop and report immediately if you encounter data of others.
• Do not degrade the service for other users, and keep automated requests to a moderate rate.
• Do not use TryFast to serve harmful code to visitors of any website, beyond a harmless proof of concept on a website you control.
• Do not publicly disclose the issue before the disclosure window below has passed or a fix is released, whichever comes first.

Safe harbor#

We will not initiate legal action or file criminal complaints against researchers who act in good faith, stay within this policy's scope and rules, and give us reasonable time to remediate. This includes research that would otherwise implicate the German computer crime provisions (§§ 202a ff. StGB), to the extent we can lawfully waive claims. If a third party initiates action against you for good-faith research under this policy, we will make it known that your actions were authorized by us.

Disclosure window#

We ask for a 90-day coordinated disclosure window from your report. If we ship a fix earlier, you are free to publish earlier; if remediation genuinely needs longer, we will explain why and agree on a new date with you. We credit researchers who wish to be named.

No bounty program (yet)#

We do not currently run a paid bug bounty program. We will say thank you, credit you if you like, and take your report seriously.

View as markdown