1---
2import LegalPage from "../components/LegalPage.astro";
3
4const sections = [
5 ["introduction", "Introduction"],
6 ["reporting", "Reporting security issues"],
7 ["safe-harbor", "Responsible research and safe harbor"],
8 ["practices", "Our security practices"],
9 ["responsibilities", "Your responsibilities"],
10 ["updates", "Updates to this policy"],
11 ["contact", "Contact us"],
12] as const;
13---
14
15<LegalPage
16 title="Security Policy — T3 Code"
17 description="How to report security issues in T3 Code and how T3 Tools approaches product security."
18 heading="T3 Code Security Policy"
19 lede="Security is a shared responsibility. This policy explains how to report a vulnerability, how we protect T3 Tools-operated services, and how you can secure the environments and providers you connect to T3 Code."
20 effectiveDate="2026-07-15"
21 lastUpdated="2026-07-15"
22 sections={sections}
23>
24 <section id="introduction">
25 <p class="section-number">01</p>
26 <h2>Introduction</h2>
27 <p>
28 This Security Policy describes the vulnerability-reporting process and security practices for
29 the T3 Code desktop and mobile applications, the hosted application at{" "}<a
30 href="https://app.t3.codes">https://app.t3.codes</a
31 >, the optional T3 Connect service, and the T3 Code website at{" "}<a href="https://t3.codes"
32 >https://t3.codes</a
33 >.
34 </p>
35 <p>
36 T3 Code connects software running on your devices and in environments you control with
37 coding-agent harnesses and providers you choose. We secure the software and infrastructure
38 operated by T3 Tools, but we do not control the security of your devices, environments,
39 repositories, networks, credentials, or third-party providers. Please review the shared
40 responsibilities below when assessing risk.
41 </p>
42 </section>
43
44 <section id="reporting">
45 <p class="section-number">02</p>
46 <h2>Reporting Security Issues</h2>
47 <p>
48 If you believe you have found a security vulnerability affecting T3 Code or T3 Tools-operated
49 infrastructure, email{" "}<a href="mailto:security@ping.gg">security@ping.gg</a>. Please do not
50 disclose the issue publicly until we have had a reasonable opportunity to investigate and
51 remediate it.
52 </p>
53 <p>Please include, when available:</p>
54 <ul>
55 <li>A description of the issue and its potential impact;</li>
56 <li>The affected application, version, URL, endpoint, or component;</li>
57 <li>Clear reproduction steps or a minimal proof of concept;</li>
58 <li>Relevant logs, screenshots, or request and response details with secrets removed; and</li>
59 <li>Your preferred contact information and whether you want public credit.</li>
60 </ul>
61 <p>
62 We aim to acknowledge complete reports within one business day, keep reporters informed of
63 material progress, and coordinate disclosure after a fix is available. Resolution time varies
64 with severity, complexity, and dependencies on third parties.
65 </p>
66 </section>
67
68 <section id="safe-harbor">
69 <p class="section-number">03</p>
70 <h2>Responsible Research and Safe Harbor</h2>
71 <p>
72 We support good-faith security research. If you make a genuine effort to comply with this
73 policy, avoid harm, respect privacy, and report findings promptly, we will treat your research
74 as authorized and will not initiate legal action against you for accidental, good-faith
75 violations of this policy. If a third party initiates legal action concerning compliant
76 research, we will make our authorization known where appropriate.
77 </p>
78 <p>To remain within this safe harbor, you must:</p>
79 <ul>
80 <li>Test only accounts, data, and systems you own or have explicit permission to test;</li>
81 <li>Stop and report immediately if you encounter personal, confidential, or production data;</li>
82 <li>Access only the minimum information needed to demonstrate the issue;</li>
83 <li>Avoid disrupting availability, degrading performance, or damaging or deleting data;</li>
84 <li>Not use social engineering, phishing, physical attacks, or denial-of-service testing;</li>
85 <li>Not test third-party services or infrastructure outside T3 Tools’ control; and</li>
86 <li>Give us reasonable time to address the issue before public disclosure.</li>
87 </ul>
88 <p>
89 This safe harbor does not authorize violations of law or activity outside the scope of this
90 policy. Vulnerability rewards are not guaranteed and, if offered, are determined by T3 Tools
91 in its discretion.
92 </p>
93 </section>
94
95 <section id="practices">
96 <p class="section-number">04</p>
97 <h2>Our Security Practices</h2>
98 <p>
99 We use administrative, technical, and organizational safeguards designed for the nature of T3
100 Code and the information processed by T3 Tools-operated services. These practices include:
101 </p>
102 <ul>
103 <li>
104 <strong>Data minimization.</strong> T3 Code is designed so coding-session content can remain
105 between your clients, your environment, and the harnesses and providers you configure. We
106 process information through T3 Tools-operated infrastructure only when needed for a feature
107 you enable.
108 </li>
109 <li>
110 <strong>Encrypted transport.</strong> T3 Tools-operated network services use encrypted
111 transport. Supported connection flows use scoped credentials and security controls designed
112 to reduce unauthorized reuse.
113 </li>
114 <li>
115 <strong>Credential protection.</strong> T3 Code uses platform-provided protected storage for
116 credentials and session tokens where supported. We design operational logging to avoid
117 collecting secrets that are not needed to operate or troubleshoot the Services.
118 </li>
119 <li>
120 <strong>Access controls.</strong> Access to production systems and operational data is limited
121 according to job responsibilities and protected using authentication and authorization
122 controls.
123 </li>
124 <li>
125 <strong>Maintenance and monitoring.</strong> We monitor T3 Tools-operated services for
126 reliability and security events, review dependencies, and deploy updates and mitigations as
127 appropriate.
128 </li>
129 <li>
130 <strong>Established providers.</strong> We use specialized providers for services such as
131 authentication, hosting, and application distribution and evaluate the controls relevant to
132 their role.
133 </li>
134 </ul>
135 <p>
136 No system is completely secure. These practices reduce risk but do not guarantee that the Site
137 or Services will be free from vulnerabilities or unauthorized access.
138 </p>
139 </section>
140
141 <section id="responsibilities">
142 <p class="section-number">05</p>
143 <h2>Your Responsibilities</h2>
144 <p>
145 Because you control much of the T3 Code execution path, you play an important role in securing
146 it. You are responsible for:
147 </p>
148 <ul>
149 <li>Keeping T3 Code, your operating systems, and connected tools up to date;</li>
150 <li>Securing your devices, repositories, environments, networks, and backups;</li>
151 <li>Protecting account, provider, repository, and environment credentials;</li>
152 <li>Using multi-factor authentication where your identity and coding-agent providers support it;</li>
153 <li>Granting providers and integrations only the permissions they need;</li>
154 <li>Reviewing commands, source changes, and other agent output before applying or executing it;</li>
155 <li>Removing lost or unused devices and revoking credentials you believe may be compromised; and</li>
156 <li>Following the security policies of your selected harnesses, providers, and infrastructure.</li>
157 </ul>
158 <p>
159 Do not send passwords, API keys, access tokens, or private keys in a vulnerability report.
160 Revoke any secret that may have been exposed before sharing sanitized evidence with us.
161 </p>
162 </section>
163
164 <section id="updates">
165 <p class="section-number">06</p>
166 <h2>Updates to This Policy</h2>
167 <p>
168 We may update this Security Policy as T3 Code, our infrastructure, and security practices
169 evolve. We will post revisions at this URL and update the dates above. Material changes to the
170 vulnerability-reporting process or safe-harbor terms will apply prospectively.
171 </p>
172 </section>
173
174 <section id="contact">
175 <p class="section-number">07</p>
176 <h2>Contact Us</h2>
177 <p>
178 Report security issues or ask security-related questions at{" "}<a
179 href="mailto:security@ping.gg">security@ping.gg</a
180 >.
181 </p>
182 <p>
183 For general legal questions, contact{" "}<a href="mailto:legal@t3.tools">legal@t3.tools</a>.
184 For privacy requests, contact{" "}<a href="mailto:privacy@t3.tools">privacy@t3.tools</a>.
185 </p>
186 </section>
187</LegalPage>