Keep the data boundary clear.
Updated 11 October 2026
Report a vulnerability
Send a private report to info@datamon.app. Include the affected route, safe reproduction steps, expected behavior and observed impact. Do not include session cookies, API keys or another person’s data. Use only resources you own or are authorized to test. Do not disrupt service or access other users’ records.
Local and connected work
The browser workspace keeps ordinary editing local. Optional cloud endpoints scope records to an anonymous workspace session. Sessions are bearer credentials, not identity-verified accounts. Keep backups and avoid shared browsers for sensitive work.
Public sharing
Published charts and their underlying values are visible to anyone with the public link. The edit token protects changes, not viewing. Uploaded image URLs are also capability links. Do not use an unlisted link as a confidentiality control.
Implemented safeguards
The implementation validates structured AI actions, bounds request bodies and upload sizes, checks workspace ownership and publication credentials, and uses rate limits for connected services. Uploaded supported images are converted to WebP. These controls are not a security certification or a guarantee that every deployment is configured correctly.
Deployment responsibilities
Use HTTPS, private object storage, protected infrastructure credentials and a shared rate-limit backend. Disable development routes, restrict worker endpoints and ensure backups and retention are configured. Keep dependencies updated and review provider terms before processing confidential information.
Disclosure coordination
We will use reports to investigate and coordinate remediation. This policy does not promise a bounty or a fixed response deadline. If you have not received a reply, follow up with the same report and avoid publishing private data.