Report a vulnerability
Email security@marketmage.io with the steps to reproduce it. We confirm receipt within one business day and keep you updated until it is fixed.
Please give us a reasonable time to fix the problem before you disclose it, and don’t access other people’s data or disrupt their service while testing. We won’t take action against good-faith research that follows these rules.
How the plugin is built
- No servers of ours. The plugin is a set of instructions (skills) plus Apify’s hosted connector. Its source is public at https://github.com/MarketMage/plugin.
- Apify’s sign-in. You connect with Apify OAuth; we never see or store a token. Apify’s scope is full access to your Apify account.
- A short tool list. The connector exposes only the general tools the skills use: starting a run (always with a spending cap), reading runs and storage, creating, changing or pausing tasks and schedules (no delete), and read-only API requests. Those tools can technically start any Apify actor and read any part of your account; the skills only start CleanPull’s actors and only touch MarketMage’s own watches.
-
Instructions, not a technical limit. The skills read and change only the
watchlists they created (
cw-…) and read only task, schedule and run paths. That is how the skills tell Claude to behave; the connector itself can read any task, schedule or run in your account. - Secrets stay out of the chat. Email keys, SMTP passwords and webhook addresses are pasted on the task’s page in the Apify Console and stored encrypted by Apify. When a skill edits a task, it passes encrypted values back unchanged and checks afterwards that they are still there.
- Provider keys stay with us. The keys for our data providers are encrypted secrets on Apify, read once by the actor at start-up, and never written to your input, logs or results.
- Spending limits. Runs started in the chat carry an Apify spending cap; scheduled runs carry a maximum cost per run that the actors hold themselves to.