Vulnerability disclosure

2026-11-03. Email [to be confirmed: contact email] with affected versions, steps to reproduce and the likely impact. Avoid including customer secrets; ask for a secure transfer method if the report needs sensitive evidence.

I aim to acknowledge a report within two business days and provide a fix or mitigation within 90 days. If a fix needs longer, I will explain the constraint and agree on a disclosure schedule with the reporter.

Good-faith research is welcome. Do not access another customer's data, disrupt the service, retain unnecessary personal data or attack third-party providers. I will not pursue legal action for research that follows this policy and stays within systems I control; I cannot authorize testing of Paddle, Apple or an IdP.

There is no paid bounty. I can credit you, or keep your name private, as you prefer.