Effective: 2026-10-14

Shuichi — Security Disclosure Policy

Reporting a vulnerability

If you find a security issue in Shuichi (the Mac app), our website, our update feed, or our license/checkout worker, email hello@shuichi.app with a description and, if you have one, steps to reproduce. Please give us a reasonable time to fix an issue before disclosing it publicly.

We do not currently run a bug-bounty program.

Response time

We acknowledge a security report within 3 business days and tell you what we plan to do about it. We let you know when the issue is fixed.

Scope

In scope: the Shuichi macOS app (app.notchone); shuichi.app (marketing site); updates.shuichi.app (software-update feed); the key server at keys.shuichi.app (Creem webhook, key renewal, billing-portal links).

Out of scope: social engineering, physical access to a device, or denial-of-service testing; vulnerabilities in third-party services we use but do not operate (Creem, Cloudflare, Hugging Face, GitHub; please report those directly to the relevant company); the bundled open-source components (whisper.cpp, sherpa-onnx, GRDB, Sparkle; please report upstream — we still want to know if a specific integration in Shuichi is affected).

What we do with a report

We will confirm we received your report, investigate, and let you know when a fix ships. We credit reporters by name in release notes if you would like that, and stay silent if you would not.

Good-faith research

If you research a vulnerability in good faith and follow this policy — you test only against your own copy and accounts, do not access or change other people's data, do not degrade our services, and give us reasonable time before disclosing — we will not take legal action against you for that research. This promise covers only us; it cannot bind Creem, Cloudflare or other companies whose systems are out of scope.

Why this matters for how Shuichi is built

Shuichi's core makes no network calls by design: dictation, clipboard, notes and calendar features work entirely offline, and every key is verified by a local, offline cryptographic check. Two license-related requests use the network, both only for subscriptions: renewing the key and opening the billing portal. Each carries the key itself and nothing you made in the app. This narrows what a compromise of our infrastructure could actually expose about your use of the app.

Contact

hello@shuichi.app