Security & Responsible Disclosure

1. How we protect DuckyHelper

• In transit: the app, the website and our servers talk only over HTTPS. The voice connection to our AI provider is encrypted (WebRTC with DTLS-SRTP).
• At rest: our databases and file storage are encrypted at rest by AWS. Files are never public, and links to them expire after one hour.
• Secrets: passwords are stored only as salted PBKDF2-SHA256 hashes, and the one-time codes that confirm an email or reset a password only as keyed hashes, for 10 minutes. Signing in with Google, Apple or GitHub never gives us your password there. AI and payment provider keys stay on our servers and never reach your device.
• Access: every request is checked against your sign-in and can reach only your own information. A sign-in lasts 30 days and is renewed while you keep using DuckyHelper; Sign out everywhere, or a new password, ends every one of them at once. After 10 wrong passwords, signing in to that email pauses for 15 minutes and we email you. A child's information is reachable only by the child's account and the parent's.
• The apps: the Mac app is signed with our Apple Developer ID and notarized by Apple, and its updates are signed with our own key and checked before they install, so a tampered update is refused. The Windows and Linux app and its updates come from duckyhelper.com over HTTPS, and each update is checked against the checksum our update feed lists before it installs; the Windows app isn't code-signed yet, so until it is, its updates aren't checked for a publisher's signature. Its small web server accepts connections only from the computer itself. On Ubuntu 23.10 and later, the Linux AppImage runs without the browser sandbox (Ubuntu doesn't let an AppImage set it up); the .deb package keeps it. The Windows and Linux app never clicks or types in your apps. In the Mac app, a task you ask for can (early access, where it's available on your account), and it's built not to type into a password or payment field or to type a card number; in some older versions (before 0.10.17), its on-screen actions refused password fields and its live viewing paused while one had focus.
• Payments: card details are handled only by Stripe.
• Data minimization: we don't keep your voice audio or screen pictures (unless saved to memory; the screens the Mac app remembers stay on your Mac), and we keep your age group, never your birthday.

No system is perfectly secure. If a breach affects your information, we'll tell you and the authorities as the law requires.

2. Reporting a vulnerability

Email security@duckyhelper.com with:

• what you found and where (the app version, the page or the API path),
• how to reproduce it, step by step,
• what an attacker could do with it,
• how to reach you.

Please don't put sensitive data (yours or anyone's) in the report beyond what's needed. We'll acknowledge your report within 5 business days, keep you updated, and tell you when it's fixed.

3. Good-faith research and safe harbor

If you research and report in good faith under these rules, we consider it authorized, we won't pursue legal action or ask law enforcement to act against you for it, and we'll work with you to understand and fix the problem.

Please:

• test only with accounts you own or have permission to use;
• stop as soon as you see someone else's data, don't keep or share it, and tell us;
• don't degrade the service (no load or denial-of-service testing, no spam);
• don't use social engineering, phishing or physical attacks against people or our providers;
• don't test our providers' systems (AWS, our AI provider, Google, Stripe, Apple); report issues in them to them;
• give us a reasonable time to fix the problem (we aim for 90 days) before telling anyone else.

Out of scope: reports from automated scanners without a demonstrated impact, missing security headers without an exploit, self-cross-site-scripting, clickjacking on pages with no sensitive actions, and attacks that need a compromised device.

This safe harbor covers only MingLLM's own claims. We can't authorize testing of other companies' systems. If you're unsure whether something is in scope, ask us first.

4. Rewards

We don't offer paid bounties at this time. If you'd like, we'll thank you by name on this page once the issue is fixed.

5. Contact

security@duckyhelper.com. For anything else: support@duckyhelper.com.