Threadway

Security

How accounts and captured data are protected, what is deliberately not protected, and how to report a vulnerability.

Reporting a vulnerability

Email support@threadway.cloud with enough detail to reproduce it: the URL or endpoint, what you did, and what happened. A proof-of-concept helps. Please report privately first rather than posting publicly, so there is a chance to fix it before it is used.

Testing against your own account is fine and welcome. What is not fine is anything that reaches other people's data or degrades the service for them: no testing against other users' tunnels, subdomains or capture endpoints, no automated scanning that amounts to a denial of service, no social engineering of the operator or the hosting provider. Reports made in good faith within those lines will not be met with legal action.

This is a one-person operation. There is no bounty programme and no promised response time; saying otherwise would be a commitment that could not be kept. Reports are read.

Accounts

Passwords are hashed with bcrypt (cost 12). They are never stored or logged in a recoverable form, and nobody here can read yours.
Two-step verification is available and sends a one-time code to your email address. It is not an authenticator app; if you need TOTP, it is not here yet and this page will say so when it is.
Recovery codes are issued so losing access to your email does not mean losing the account.
Sessions and API keys can be revoked individually or all at once from your account page. Changing your password invalidates existing sessions.
Repeated failed logins lock the source address out temporarily, and a persistent offender is blocked outright.

Your captured data

Captures belong to your account. They are not pooled with other users' and are not readable by other accounts.
A share link is a capability. Anyone holding the URL can read that capture endpoint without signing in, which is what makes it useful for handing to a client. Treat it like a password, and revoke it when the job is done. Share pages are excluded from search engines.
Retention is set by your plan. Captures older than that window are pruned automatically, and deleting a capture endpoint deletes what it collected.
What is kept, for how long, and how to have it removed is set out in the Privacy Policy.

The client and updates

The client verifies TLS by default. --insecure exists for a self-signed panel certificate and does what its name says.
For a self-signed control channel, the client pins the certificate on first contact and refuses a silent change afterwards.
Updates are verified against a SHA-256 checksum published by this panel. A build that does not match is not installed.

Oversight

Administrative actions are written to an audit log whose entries are chained together by hash, so a record cannot be altered or removed without breaking the chain. That covers things done to your account by an operator, including plan changes and subscription cancellations.

What this does not protect

Worth being plain about, because the alternative is you finding out later.

The hop between the client and the tunnel server is plaintext unless you pass --tls. The public visitor's leg is HTTPS either way. For anything sensitive, run TLS at your own application too.
A tunnel makes a local service reachable from the internet. Whatever you expose is exposed, including anything it was relying on a private network to hide.
Captured requests contain whatever was sent to them, which during testing routinely includes hostnames, internal addressing and sometimes tokens. That is the point of the tool, and it is a reason to delete what you no longer need.
Threadway is operated by one person on ordinary infrastructure. There is no third-party security certification, and this page does not claim one.

Acceptable Use Policy covers what you may point Threadway at. Report abuse is for Threadway being used against you or someone else, which is a different thing from a vulnerability in Threadway itself.