How to report
Write to [email protected] with your finding. Include steps to reproduce, the affected address or component and the possible impact. The contact and the policy are also published in /.well-known/security.txt.
What you can expect
- First answer: within 3 business days.
- Fix target for critical findings: 7 days.
- Once the fix is released, thanks by name in the release notes if you wish.
Our assurances
We will not take legal action against research done in good faith and in line with this policy.
What we ask of you
- Test only on your own accounts and on test organisations you created; do not try to reach other customers' data.
- No load tests that disrupt the service, no denial-of-service attempts and no social engineering.
- If you reached data unintentionally, stop there, do not keep it and tell us.
- Do not share the finding with others until it is fixed.
Scope
The web app and API, the browser extension, the mobile app and the forwarder app (once released), and this site. Self-hosted copies are in scope too; state the version of the finding.