Token Forest Security Policy

Token Forest is a proprietary, local-first desktop application published by Poietic Studio, with no network access by default. We take reports about its security and privacy behaviour seriously — especially anything that contradicts our published Privacy Notice.

Only the latest public release receives security fixes unless a release note states otherwise. Older releases and development snapshots are unsupported — please upgrade.

Please report suspected vulnerabilities privately:

• ✦Preferred: GitHub private vulnerability reporting — https://github.com/Ericcccccc777/Poietic-TokenForest/security
• ✦Email: contact@tokenforest.com.au with a subject line starting with [SECURITY]. A dedicated security@tokenforest.com.au inbox is being set up

Please do not open a public issue for an unpatched vulnerability. Ordinary bugs and feature requests are welcome in the public issue tracker.

Do not include in any report: your Claude/Codex logs, prompts or conversation content, source code, access/refresh tokens, or other users' leaderboard data. If we need artifacts, we will arrange a minimal, private way to share them.

• ✦Token Forest version and exact download filename (plus its SHA-256 if possible);
• ✦operating system and architecture;
• ✦clear impact description and reproducible steps or proof of concept;
• ✦whether the leaderboard was Off, Paused or On;
• ✦whether the issue has been disclosed anywhere else;
• ✦how you would like to be credited (or anonymity).

• ✦any upload of local logs, prompts, conversation content or source-code files;
• ✦any network request that no optional feature you turned on can account for — with the leaderboard, the price-table update and the update check all off, the app promises zero; with one of them on, anything beyond what the Privacy Notice describes for that feature (different host, extra data, higher frequency) is in scope;
• ✦a mismatch between the consent dialog / Privacy Notice and what is actually sent;
• ✦leaderboard authentication or row-level-security bypass (reading or modifying another user's row);
• ✦publishing project-showcase content that bypasses the checks the Privacy Notice describes — a link that is not https://, a name or description that evades the word screening, or an image served from anywhere other than our own storage;
• ✦reading, replacing or deleting another player's project image, or enumerating stored objects beyond what the public board displays;
• ✦a project showcase that stays published after the player switched it off, left the leaderboard, or was removed from the board;
• ✦exposure of access/refresh tokens;
• ✦local storage readable across OS user boundaries;
• ✦arbitrary code execution, unsafe archive/update handling, DLL or library hijacking;
• ✦tampering with official downloads, checksums or signatures;
• ✦failure of the advertised leaderboard-deletion flow.

Please use only your own accounts and test data, and stop once the issue is demonstrated.

• ✦UI, animation or layout bugs; feature requests;
• ✦token-count differences explained by our documented metric definitions;
• ✦SmartScreen warning that a new file is “not commonly downloaded” when signature/hash are otherwise valid;
• ✦issues requiring full prior control of the user's OS account;
• ✦automated scanner output without demonstrated impact;
• ✦social engineering of team members.

We may still act on out-of-scope reports that expose real user risk.

Targets, not guarantees: acknowledge within 3 business days; initial assessment within 7 business days; status updates at least every 14 days for confirmed issues. For critical issues we may pull affected downloads immediately. Fixes are rebuilt from a clean commit, re-signed where applicable, republished with new checksums, and announced in the release notes; withdrawn binaries stay marked rather than silently rewritten.

If you act in good faith — avoid privacy harm, use only your own data, allow reasonable time to fix — we will work with you, and with your permission credit you in the release notes.

Requests to delete a leaderboard entry or questions about data handling are not vulnerabilities — see the Privacy Notice contact section. Never send anyone your account.json tokens.

Official downloads come only from this website and the product repository's GitHub Releases, each with a SHA-256 checksum and a stated signing status — except four early builds: v0.1.0, v0.1.1 and v0.1.2 published no checksum, and v0.1.9 neither a checksum nor a signing status. Do not run a download that fails verification — delete it, re-download from an official channel, and report it if the mismatch persists.