Security

Reporting a security problem

Last updated 17 August 2026. Gustalabs is a small operation in Sweden, run by one person. There is no bug bounty and no payout, but every genuine report is read by the person who can actually fix it.

How to reach us

Email support@gustalabs.com with "security" in the subject, or use the in-app support circle if you have an account. Both land in the same queue. Please include enough detail to reproduce the issue: the app, the URL, what you did, and what happened. A short proof of concept is worth more than a scanner report.

We aim to acknowledge a report within five working days. Fixes ship when they are ready; a serious issue is treated as the only thing that matters that day.

What is in scope

• The apps: Gusta Music, Gusta 3D, Gusta Draw, Gusta GIF, Gusta Game, Gusta Video, and this site.
• The Gusta Core API at core.gustalabs.com: accounts, sessions, the token wallet, cloud saves, and the AI gateway.

The things we care about most: anything that lets one account read or change another account's data, anything that leaks or forges an account token, anything that spends someone else's tokens, and cross-site scripting on any origin that holds a token.

What is not a vulnerability

To save you the trouble of writing these up:

• Our client-side code is readable. Several apps ship unminified JavaScript on purpose. Everything a browser runs is public by definition, and nothing in it is a secret. All credentials live server-side.
• The application key in the page is publishable. The X-Gusta-App key identifies which product is calling. It grants nothing on its own: every request that touches an account or spends tokens also requires that user's own bearer token.
• The AI assistant can be talked into odd replies. Prompt injection that only affects the model's own answer, in the reporter's own session, is not a security boundary crossing. Injection that reaches another user's data or spends another user's tokens is, and we want to hear about it.
• Missing security headers on origins that serve no credentials, output from automated scanners with no demonstrated impact, best-practice opinions about TLS configuration, and reports asking for payment before disclosing details.

Testing, and what we ask

Test against your own account and your own data only. Do not run denial-of-service or load tests, do not attempt to access another person's account, and do not spam the AI gateway to prove it costs money. If you access someone else's data by accident, stop, and tell us what you saw so we can measure the exposure.

If you follow those rules and report in good faith, we will not pursue you and we will not complain to your employer or your host. We will credit you by name here if you want, once the fix is live.

What we run

All servers are in the EU (AWS Stockholm). Traffic is TLS only, with HSTS. Passwords are stored hashed and never logged. Account tokens are opaque, revocable, and sent only as an Authorization header to the Gusta Core origin. Every app enforces a content security policy that forbids third-party script. Provider API keys exist only inside Gusta Core and never reach a browser. What we store, for how long, and how to erase it is set out in the privacy policy.