Security Policy

Thunder Client takes the security of our products and services seriously. We welcome responsible disclosure from security researchers and the developer community.

If you believe you have found a security vulnerability in Thunder Client, please report it to us by emailing thunderclient [dot] com.

Please include:

• A description of the vulnerability
• Steps to reproduce the issue
• The potential impact
• Any suggested remediation (optional)

• Acknowledgement of your report within 3 business days
• Regular updates on our investigation
• We will work to remediate confirmed vulnerabilities promptly
• We will not take legal action against researchers acting in good faith

• Thunder Client VS Code extension
• Thunder Client JetBrains plugin
• thunderclient.com website and associated infrastructure

• Denial of service attacks
• Social engineering of Thunder Client staff
• Physical security attacks

Thunder Client does not currently offer monetary rewards for vulnerability reports. We do recognise researchers who report valid, significant vulnerabilities with a public acknowledgement (with their permission).