Security & Responsible Disclosure

Reporting a flaw

Write to [email protected]. If that does not reach us, [email protected] does.

Tell us what you found, how to reproduce it, and what you think the impact is. A short note with a working reproduction is worth more than a long report without one.

The same contacts are published in machine-readable form at /.well-known/security.txt, per RFC 9116, for tooling that looks there first.

What we commit to

We acknowledge reports within three working days.

We will not pursue legal action against research conducted in good faith against our own systems, and we will tell you when the issue is fixed.

We do not currently run a paid bounty programme. Saying so plainly is fairer than leaving it to be inferred after somebody has spent a weekend on it.

Please do not test against another tenant

Cross-tenant isolation is the property we most want tested, and the wrong way to test it is with somebody else’s data.

Ask us for a second organisation and we will give you one. We would far rather hand you an account to attack than have you use a real customer’s.

Please also avoid anything that degrades the service for others — denial of service, mass automated scanning, or social engineering of our staff or customers.

How the platform is built to fail safely

Passwords are hashed with Argon2 and are not recoverable. Access is scoped by role, and every privileged action is written to an append-only audit log the account holder can read.

Neither database is reachable from the public internet; the only inbound path is through the CDN tunnel.

Credential-shaped values are stripped from incoming telemetry before it is stored, and again from the operational alerts our own systems send us.

Session recordings are masked in the browser before transmission, so masked content never reaches our servers at all.