This policy tells a security researcher how to report a vulnerability in Metzia, what Metzia does with the report, and what Metzia promises in return. Metzia is the trade name of OpenWebShop LLC, a Florida limited liability company.
Report a vulnerability
Send the report to security@metzia.ai.
Do not open a public issue, and do not post the vulnerability in public before the fix is live.
Put these items in the report:
- The affected URL, API route, or package.
- The steps that show the issue.
- The impact that you expect.
- An address where Metzia can reach you.
The machine readable contact is at /.well-known/security.txt.
What happens next
- Metzia acknowledges the report within three business days.
- Metzia confirms the issue and gives it a severity within ten business days.
- Metzia fixes a critical or high issue as soon as possible, and tells you the plan.
- Metzia tells you when the fix is live. Metzia names you in the fix notes if you ask.
Disclosure
Give Metzia 90 days from your report to fix the issue before you publish it. When the fix is live earlier, you can publish after Metzia tells you. When Metzia needs more time, Metzia tells you why and asks you for a new date.
Scope
These items are in scope:
metzia.aiand its subdomains.- The MCP server at
https://metzia.ai/api/mcp. - The
@metzia/sdkpackage.
These items are out of scope:
- A denial of service test, a load test, or a spam test.
- Social engineering of staff, sellers, or buyers.
- A physical attack on an office or a device.
- A scanner report with no proof of impact.
- A service that Metzia uses, such as Descope, WorkOS, Vercel, or Neon. Report that issue to the vendor.
- The site of a seller. Report that issue to the seller.
Rules for a test
- Use only an account that you own.
- Stop at the minimum access that shows the issue.
- Do not read, change, delete, or keep the data of another person. If you see such data by accident, stop, tell Metzia, and delete your copy.
- Do not degrade the service for other users.
Safe harbour
Metzia takes no legal action against you for a test that follows this policy in good faith. Metzia does not report such a test to law enforcement. When a third party takes action against you for a test that followed this policy, Metzia tells that party that the test was authorized.
This promise does not cover a test that breaks the rules above, and it does not bind a vendor or a seller.
No paid bounty
Metzia runs no paid bug bounty. Metzia pays no reward for a report. Metzia thanks you in the fix notes if you ask.
How Metzia protects the service
- Every connection to Metzia uses HTTPS. The site sends a Strict Transport Security header, so a browser refuses a plain HTTP connection.
- Secrets live in the encrypted store of the hosting provider, not in the source code. A check on every pull request fails when a secret appears in the code.
- Buyers sign in through Descope. Sellers and staff sign in through WorkOS. Metzia stores no password.
- A buyer confirms the removal of an authenticator app with that app. A password reset needs only the link that goes to the verified email address of the account.
- Each staff action on a seller, a buyer, or a privacy request writes a row to an append only audit log. Only a superadmin can take an action that cannot be undone.
- Anyone, including an agent, can read the public catalog pages with no grant. An agent that acts for a buyer through the Metzia MCP server needs a scoped access grant. The buyer approves the grant and can revoke it at any time.
- Before an error report leaves the service, a filter removes named fields and patterns from it. These are request bodies, cookies, credential headers, URL query strings, buyer prompts, and email addresses.
Changes to this policy
Metzia publishes a new version of this policy with a new version date. The older version stays readable.