---
import LegalPage from "../components/LegalPage.astro";

const sections = [
  ["introduction", "Introduction"],
  ["reporting", "Reporting security issues"],
  ["safe-harbor", "Responsible research and safe harbor"],
  ["practices", "Our security practices"],
  ["responsibilities", "Your responsibilities"],
  ["updates", "Updates to this policy"],
  ["contact", "Contact us"],
] as const;
---

<LegalPage
  title="Security Policy — T3 Code"
  description="How to report security issues in T3 Code and how T3 Tools approaches product security."
  heading="T3 Code Security Policy"
  lede="Security is a shared responsibility. This policy explains how to report a vulnerability, how we protect T3 Tools-operated services, and how you can secure the environments and providers you connect to T3 Code."
  effectiveDate="2026-07-15"
  lastUpdated="2026-07-15"
  sections={sections}
>
  <section id="introduction">
    <p class="section-number">01</p>
    <h2>Introduction</h2>
    <p>
      This Security Policy describes the vulnerability-reporting process and security practices for
      the T3 Code desktop and mobile applications, the hosted application at{" "}<a
        href="https://app.t3.codes">https://app.t3.codes</a
      >, the optional T3 Connect service, and the T3 Code website at{" "}<a href="https://t3.codes"
        >https://t3.codes</a
      >.
    </p>
    <p>
      T3 Code connects software running on your devices and in environments you control with
      coding-agent harnesses and providers you choose. We secure the software and infrastructure
      operated by T3 Tools, but we do not control the security of your devices, environments,
      repositories, networks, credentials, or third-party providers. Please review the shared
      responsibilities below when assessing risk.
    </p>
  </section>

  <section id="reporting">
    <p class="section-number">02</p>
    <h2>Reporting Security Issues</h2>
    <p>
      If you believe you have found a security vulnerability affecting T3 Code or T3 Tools-operated
      infrastructure, email{" "}<a href="mailto:security@ping.gg">security@ping.gg</a>. Please do not
      disclose the issue publicly until we have had a reasonable opportunity to investigate and
      remediate it.
    </p>
    <p>Please include, when available:</p>
    <ul>
      <li>A description of the issue and its potential impact;</li>
      <li>The affected application, version, URL, endpoint, or component;</li>
      <li>Clear reproduction steps or a minimal proof of concept;</li>
      <li>Relevant logs, screenshots, or request and response details with secrets removed; and</li>
      <li>Your preferred contact information and whether you want public credit.</li>
    </ul>
    <p>
      We aim to acknowledge complete reports within one business day, keep reporters informed of
      material progress, and coordinate disclosure after a fix is available. Resolution time varies
      with severity, complexity, and dependencies on third parties.
    </p>
  </section>

  <section id="safe-harbor">
    <p class="section-number">03</p>
    <h2>Responsible Research and Safe Harbor</h2>
    <p>
      We support good-faith security research. If you make a genuine effort to comply with this
      policy, avoid harm, respect privacy, and report findings promptly, we will treat your research
      as authorized and will not initiate legal action against you for accidental, good-faith
      violations of this policy. If a third party initiates legal action concerning compliant
      research, we will make our authorization known where appropriate.
    </p>
    <p>To remain within this safe harbor, you must:</p>
    <ul>
      <li>Test only accounts, data, and systems you own or have explicit permission to test;</li>
      <li>Stop and report immediately if you encounter personal, confidential, or production data;</li>
      <li>Access only the minimum information needed to demonstrate the issue;</li>
      <li>Avoid disrupting availability, degrading performance, or damaging or deleting data;</li>
      <li>Not use social engineering, phishing, physical attacks, or denial-of-service testing;</li>
      <li>Not test third-party services or infrastructure outside T3 Tools’ control; and</li>
      <li>Give us reasonable time to address the issue before public disclosure.</li>
    </ul>
    <p>
      This safe harbor does not authorize violations of law or activity outside the scope of this
      policy. Vulnerability rewards are not guaranteed and, if offered, are determined by T3 Tools
      in its discretion.
    </p>
  </section>

  <section id="practices">
    <p class="section-number">04</p>
    <h2>Our Security Practices</h2>
    <p>
      We use administrative, technical, and organizational safeguards designed for the nature of T3
      Code and the information processed by T3 Tools-operated services. These practices include:
    </p>
    <ul>
      <li>
        <strong>Data minimization.</strong> T3 Code is designed so coding-session content can remain
        between your clients, your environment, and the harnesses and providers you configure. We
        process information through T3 Tools-operated infrastructure only when needed for a feature
        you enable.
      </li>
      <li>
        <strong>Encrypted transport.</strong> T3 Tools-operated network services use encrypted
        transport. Supported connection flows use scoped credentials and security controls designed
        to reduce unauthorized reuse.
      </li>
      <li>
        <strong>Credential protection.</strong> T3 Code uses platform-provided protected storage for
        credentials and session tokens where supported. We design operational logging to avoid
        collecting secrets that are not needed to operate or troubleshoot the Services.
      </li>
      <li>
        <strong>Access controls.</strong> Access to production systems and operational data is limited
        according to job responsibilities and protected using authentication and authorization
        controls.
      </li>
      <li>
        <strong>Maintenance and monitoring.</strong> We monitor T3 Tools-operated services for
        reliability and security events, review dependencies, and deploy updates and mitigations as
        appropriate.
      </li>
      <li>
        <strong>Established providers.</strong> We use specialized providers for services such as
        authentication, hosting, and application distribution and evaluate the controls relevant to
        their role.
      </li>
    </ul>
    <p>
      No system is completely secure. These practices reduce risk but do not guarantee that the Site
      or Services will be free from vulnerabilities or unauthorized access.
    </p>
  </section>

  <section id="responsibilities">
    <p class="section-number">05</p>
    <h2>Your Responsibilities</h2>
    <p>
      Because you control much of the T3 Code execution path, you play an important role in securing
      it. You are responsible for:
    </p>
    <ul>
      <li>Keeping T3 Code, your operating systems, and connected tools up to date;</li>
      <li>Securing your devices, repositories, environments, networks, and backups;</li>
      <li>Protecting account, provider, repository, and environment credentials;</li>
      <li>Using multi-factor authentication where your identity and coding-agent providers support it;</li>
      <li>Granting providers and integrations only the permissions they need;</li>
      <li>Reviewing commands, source changes, and other agent output before applying or executing it;</li>
      <li>Removing lost or unused devices and revoking credentials you believe may be compromised; and</li>
      <li>Following the security policies of your selected harnesses, providers, and infrastructure.</li>
    </ul>
    <p>
      Do not send passwords, API keys, access tokens, or private keys in a vulnerability report.
      Revoke any secret that may have been exposed before sharing sanitized evidence with us.
    </p>
  </section>

  <section id="updates">
    <p class="section-number">06</p>
    <h2>Updates to This Policy</h2>
    <p>
      We may update this Security Policy as T3 Code, our infrastructure, and security practices
      evolve. We will post revisions at this URL and update the dates above. Material changes to the
      vulnerability-reporting process or safe-harbor terms will apply prospectively.
    </p>
  </section>

  <section id="contact">
    <p class="section-number">07</p>
    <h2>Contact Us</h2>
    <p>
      Report security issues or ask security-related questions at{" "}<a
        href="mailto:security@ping.gg">security@ping.gg</a
      >.
    </p>
    <p>
      For general legal questions, contact{" "}<a href="mailto:legal@t3.tools">legal@t3.tools</a>.
      For privacy requests, contact{" "}<a href="mailto:privacy@t3.tools">privacy@t3.tools</a>.
    </p>
  </section>
</LegalPage>