Reporting issues
Send suspected Doer vulnerabilities to aryan@lagaryan.click. Include the affected version, operating system, reproduction steps and likely impact. Remove passwords, tokens and personal task contents from evidence. Do not publish exploitation details before we have had an opportunity to investigate.
Research only on systems and data you own or have permission to test. Do not access other users' data, interrupt their service or test third-party providers without their authorization. This policy does not grant permission to access systems or waive applicable laws.
Protecting your computer
Doer runs a local backend, reads and writes selected folders and starts provider command-line tools. Review task instructions and consequential actions, keep backups and use provider permissions appropriate for your work. Protect API keys and connected accounts. Only pair devices you trust, keep pairing links private and revoke access when a device is no longer trusted.
Keep your operating system, Doer and provider tools updated. Store builds receive updates through Microsoft Store; direct downloads use the project's release channel. Do not expose a local server publicly without an appropriately secured network configuration. No software or storage method is completely secure.
Contact and updates
Doer is operated by Aryan Gupta and Aditya Mayank Sinha. T3 Tools, Inc. is the upstream MIT copyright holder, not the operator. Security and support contact: aryan@lagaryan.click. We will revise this page as reporting guidance changes.
Connected-tool protections
Gmail uses Google OAuth with one-use sign-in state and PKCE. Gmail credentials are encrypted at rest, and desktop key storage uses operating-system protection. Gmail sign-in is disabled if secure storage is unavailable. Every connector email requires a one-time review of its exact contents; approvals cannot grant permission for future email. Disconnect revokes Google access before deleting stored credentials.
Local document edits are constrained to the selected Space, checked against the inspected version, written through a temporary file, and accompanied by an original backup. These safeguards do not protect against a compromised operating system or malicious software already running with your account's privileges.