Security

Last reviewed 2026-09-16

Helys holds artists' funding pipelines, application drafts, uploaded work samples and — for eligibility screening — demographic information. We take reports seriously.

Reporting a vulnerability

Email security@helys.com with enough detail to reproduce the issue. Please include the affected URL or endpoint, the steps you took, and what you observed. If you have a proof of concept, a minimal one is more useful than a weaponised one.

Expect an acknowledgement within 3 business days and an assessment within 10. We will tell you when the issue is fixed and whether we would like to credit you.

Please do not open a public issue for a security report.

Safe harbour

We will not pursue or support legal action against anyone who, in good faith:

• reports a vulnerability promptly and privately,
• makes a genuine effort to avoid privacy violations, data destruction, and interruption of the service,
• accesses only their own accounts and data, or accounts they have explicit permission to test, and
• gives us reasonable time to remediate before disclosing.

We do not run a paid bug bounty.

In scope

The Helys application and its API, MCP and OAuth endpoints, authentication and session handling, tenant isolation, and the handling of uploaded files and stored secrets.

Out of scope

• Denial of service, volumetric or resource-exhaustion testing.
• Social engineering of users or staff, and physical attacks.
• Missing hardening headers on static assets with no demonstrated impact.
• Reports produced solely by automated scanners with no demonstrated impact.
• Tenant-key enumeration. Workspace paths are deliberately guessable; access to each workspace is what is protected.
• Vulnerabilities in third-party services (report those to the vendor).

Things worth knowing before you test

• Authentication is passkeys only (WebAuthn, user verification required).
• Sessions, invites, API tokens, OAuth codes and tokens, and calendar-feed tokens are stored as SHA-256 hashes.
• A calendar feed URL is a bearer credential: anyone holding it can read that user's deadlines. Regenerating the feed revokes the old URL.

Contact

security@helys.com for security reports, support@helys.com for everything else. This page is the Policy URL in /.well-known/security.txt.