Nagi.md
日本語English
Open web app

HomeLegal information

SECURITY POLICY

Vulnerability Disclosure Policy

How to report vulnerabilities and how we investigate and fix them.

Last updated
  1. 01Privacy Policy
  2. 02Terms of Service
  3. 03Legal Notice under the Act on Specified Commercial Transactions
  4. 04Vulnerability Disclosure Policy
On this page
  1. Scope
  2. How to report
  3. Response process
  4. Research guidelines and good faith
  5. Rewards and contact

The Japanese version is authoritative if translations differ. However, wording in another language does not adversely alter explanations presented to you or rights under consumer protection laws.

1. Scope

This policy covers the Nagi.md website (nagi-md.com), web app, VS Code extension, desktop app, and checkout and subscription management pages and API. Report vulnerabilities in third-party services themselves, such as Paddle, Google Firebase, or AWS, to their providers.

2. How to report

Email support@nagi-md.com with “脆弱性” (vulnerability) in the subject.

  • Affected page, feature, or version; a description and likely impact.
  • Reproduction steps and minimal proof-of-concept code or screenshots.
  • Time and environment of discovery and a reply address.

Do not send other people’s personal information, card numbers, authentication codes, or tokens. Contact us to arrange a safe sharing method before sending confidential material.

3. Response process

  • We aim to acknowledge receipt within five business days.
  • We investigate reproduction and impact and share our response plan and progress.
  • We aim to fix critical vulnerabilities within 30 days and others within 90 days. If impact or complexity requires longer, we explain the reason and expected timeline.
  • After fixing and checking the issue, we coordinate disclosure timing and content with the reporter.

These are targets, not guarantees that every report will be fixed within the stated period.

4. Research guidelines and good faith

  • Use devices and accounts you are authorized to test and limit testing to what is necessary to confirm the issue.
  • Do not access, collect, change, or delete other people’s information. If you encounter it unintentionally, stop and notify us without spreading it.
  • Do not perform disruptive load tests, spam, social engineering, or similar activities.
  • Discuss disclosure timing with us in advance to allow an opportunity to fix the issue.

We will not take legal action against good-faith research and reporting consistent with this policy. This does not bind third parties or their legal actions.

5. Rewards and contact

There is no bounty program. We publish acknowledgments only with the reporter’s consent. Contact support@nagi-md.com. Adopted and last updated October 11, 2026.

Nagi.mdBack to top ↑