auto·printer

Security

Responsible Disclosure Policy

Last updated: April 25, 2026

Autoprinter is published by Econocraft Materials LLC. We take security reports seriously. If you believe you have found a vulnerability in Autoprinter — the Shopify app, the Desktop Utility, the Chrome Extension, or any of our domains — please report it to us privately before disclosing it publicly.

How to report

Email security@autoprinter.app with:

  • A clear description of the vulnerability and where you found it (URL, app component, or specific endpoint).
  • Steps to reproduce, or a proof-of-concept if you have one.
  • The impact you believe a malicious actor could achieve.
  • Any suggested mitigation (optional).

Please use plain email. We don't currently publish a PGP key. If you need to send sensitive material and prefer encryption, mention that in your initial email and we'll arrange a channel.

What's in scope

  • app.autoprinter.app (the Shopify embedded app and its public API endpoints)
  • The Autoprinter Chrome Extension (label-capture extension distributed by Econocraft Materials)
  • The Autoprinter Desktop Utility (macOS and Windows app distributed by Econocraft Materials)
  • The pairing-code and device-token authentication flow
  • The print-job queue and PDF rendering pipeline
  • autoprinter.app (the root domain)

What's out of scope

  • Subprocessors with their own disclosure programs. Vulnerabilities in Railway, Sentry, Resend, PostHog, or Shopify itself should be reported to those vendors directly. We're happy to coordinate if a bug spans both Autoprinter and a subprocessor.
  • Spam, phishing, or social-engineering attempts that don't depend on a bug in Autoprinter.
  • Volumetric denial-of-service testing without prior written agreement. Confirming that an endpoint exists is fine; sustained load testing is not.
  • Issues without security impact (e.g. missing best-practice headers on a static page, version disclosure, self-XSS that requires the victim to paste attacker-controlled code into their own console). We may still appreciate the heads-up but won't treat them as vulnerabilities.

Acceptable testing

  • Use only your own merchant account, your own dev store, or accounts you have explicit permission to test against. Do not attempt to access another merchant's data or another customer's orders.
  • Do not modify or destroy data that doesn't belong to you.
  • Do not run automated scans that generate sustained load against our production infrastructure. Targeted, hand-crafted requests are fine; a brute-force or fuzzing campaign at scale is not.
  • Do not pivot from one finding to another component without telling us first. If you find something that suggests deeper access is possible, stop and report what you have.
  • Do not post the finding publicly, share it on social media, or hand it to a third party until we've had a chance to fix it and we've agreed on a coordinated disclosure timeline.

Safe harbor

If you make a good-faith effort to comply with this policy, we will:

  • Not pursue legal action against you for the testing activity itself.
  • Not refer the matter to law enforcement so long as your actions stay within the bounds described above.
  • Work with you to understand and resolve the issue.

This safe harbor applies to the activities described in this document and does not waive any rights against actions outside its scope (for example, accessing data belonging to other merchants, exfiltrating customer information, or extorting payment for non-disclosure).

What you can expect from us

  • Acknowledgement within 3 business days of your initial report.
  • An initial assessment within 7 business days, including whether we consider the issue valid and an estimated severity.
  • Periodic status updates while we work on a fix — at minimum, every 14 days until the issue is resolved or we've explained why we are not addressing it.
  • Credit on request. When we publish a fix, we are happy to acknowledge you (handle, real name, or anonymous — your choice). If you'd rather not be named, we won't name you.

We do not currently run a paid bug bounty program. We may revisit that in the future; in the meantime, we genuinely appreciate every report.

Coordinated disclosure timeline

Our default coordinated-disclosure window is 90 days from the time we acknowledge a report. If a fix takes longer than that, we will explain why and propose an extension; if you disagree with the extension we will not publicly contest your decision to disclose earlier.

For active in-the-wild exploitation we will move faster — we'll engage within 24 hours and ship a fix as soon as one is available.

Contact

security@autoprinter.app

For non-security issues (billing, support, general questions), please use support@autoprinter.app instead.