# Security Policy

Last updated 4 October 2026. Marsell is operated by ABADAAN ARBABI HOLDINGS LLC, a Wyoming limited liability company.

URL: https://getmarsell.com/security

Marsell markets and sells for businesses. It holds their data, their connected accounts and their approval over
everything it posts, sends and spends. If you find a way around any of that, we want to hear about it.

## Reporting a vulnerability

Email **security@getmarsell.com**. Please don't report a security problem in public, for example in a GitHub issue, pull
request or discussion.

Include what you can of:

- what the problem is, and what someone could do with it;
- the steps to reproduce it: the URLs, endpoints or requests involved, and the account or setup you used;
- a proof of concept (screenshots, a short video, a script);
- how you would like to be credited, if at all.

If you can't share something safely by email, say so in a first message and we will agree on another way.

## What happens next

- We acknowledge your report within **3 business days**.
- We tell you what we found, and whether we accept the report, within **10 business days**.
- We aim to fix critical issues within **30 days** and the rest within **90 days**, and we keep you posted until the fix
  ships.
- With your permission, we thank you by name when the fix is announced. We don't run a paid bug bounty yet.

We ask you to keep the details private until a fix is live, or for 90 days from your report, whichever comes first.
If we need longer, we will tell you why and agree on a date with you.

## Scope

In scope:

- **getmarsell.com**: the website, the workspace (`/app`) and the API behind it (`/api`).
- **Hosted sites** on `*.marsell.site` and on getmarsell.com's `/_sites/` paths: the hosting itself, not the content our
  customers publish there.
- **Marsell's code**, as it runs in production. Marsell is a hosted service that is deployed continuously, so only the
  live service and its latest code are supported; there are no older versions to patch.

We especially care about:

- one business, or anyone else, reaching another business's data, files, films or connected accounts;
- getting Marsell to post, send, publish or spend without the owner's approval, including by planting instructions in
  a website, comment, email or file that Marsell reads (prompt injection);
- account takeover, or bypassing sign-in or the invite list;
- leaking tokens for accounts customers connect (Google, YouTube, social platforms, email);
- making the servers fetch private or internal addresses (SSRF) through the site crawler, image downloads or imports;
- script injection that crosses from a hosted site into getmarsell.com;
- tampering with plans, token balances or billing.

Out of scope:

- vulnerabilities in the services we use (our hosting, sign-in, payment, AI and media providers); please report
  those to the provider. A way to misuse *our* integration with them is in scope;
- denial of service, load testing, and spam;
- social engineering, phishing, and physical attacks against people or offices;
- scanner output, missing headers or best practices without a demonstrated impact;
- self-XSS, clickjacking on pages with no sensitive action, and logout or login CSRF;
- content that customers publish on their hosted sites; report abuse to security@getmarsell.com as well, and we will
  route it;
- keys, passwords and tokens in tests and fixtures, which are fake on purpose. A report about a leaked secret needs to
  show a real, working credential. Don't use it beyond confirming that it works.

## Testing rules

- Test only against accounts you created. Never access, change or delete another person's data; if you reach any by
  accident, stop, don't keep a copy, and tell us.
- Don't degrade the service for others: no denial-of-service tests, and keep automated requests to a gentle rate.
- Don't let Marsell post, send or spend anything real on a third party's behalf while you test.
- Give us reasonable time to fix a problem before you disclose it.

## Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized. We won't take legal
action against you or ask anyone else to, and if someone else does over research that followed this policy, we will
make it known that you acted with our permission. If you're unsure whether something is allowed, ask us first at
security@getmarsell.com.

---

Every page of this site in one file: https://getmarsell.com/llms-full.txt. The site's guide for AI: https://getmarsell.com/llms.txt