Hidden Tokens: reporting a vulnerability
Updated 9 November 2026 · publisher: Tardigrade SARL · contact: info@hiddentokens.com
If you have found a security problem in Hidden Tokens, tell us privately and we will fix it with you. Use fictitious data only: never send us real personal data.
How to report
Write to info@hiddentokens.com with SECURITY at the start of the subject. Give the component and its version, the steps to reproduce and the impact you see. English or French. The machine-readable contact is at /.well-known/security.txt.
What is in scope
The connector for Claude, the desktop app and its local service, the browser extension, the admin console, the Claude Code plugin, the Excel add-in and this website.
Beyond the usual defects, we treat as a vulnerability:
| Finding | Why it matters |
|---|---|
| A real value reaches the AI or a tool result | The product's first rule is that the AI only sees coded copies |
| The AI can read the key or a decoded file | The key must stay on the workstation, out of the AI's reach |
| A network request that is not declared | The software makes none by default: see the IT and security sheet |
| A signature check that can be bypassed | Policy, registry, licence, seal and updates rely on it |
What you can expect from us
| Step | Our commitment |
|---|---|
| Acknowledgement | Within 3 business days |
| Follow-up | We tell you what we reproduced, how serious we rate it, and when a fix is planned |
| Fix | Free, shipped through the normal update, with a release note |
| Disclosure | On a date agreed with you, 90 days at most by default; credit in the release notes if you wish |
We will not take legal action against good-faith research carried out on your own computers with fictitious data. There is no bug bounty at this stage.
What we do not hold
We run no server for customers and receive none of their files, keys or logs. A report can therefore never require access to someone else's data: please do not try.
Status
Hidden Tokens holds no security certification and no independent audit has been published yet. This page says so until that changes.