Responsible Disclosure

Use the contact form and say it is a security report. Include what you found, how to reproduce it, and what you think it lets someone do. If you would rather send it encrypted, say so first and we will arrange a key. Contact us.

• Acknowledge your report. We aim to do that within three business days — an intention, not a service level, and we would rather say so than publish a number we do not measure.
• Tell you what we conclude, including when we decide something is not a vulnerability, and why.
• Fix what we can, and tell you honestly if a fix is going to take time or if we decide not to fix something.
• Credit you by name when a report leads to a change, if you want to be credited.

We do not run a bug bounty and cannot offer payment. We would rather say that plainly than imply a reward that does not exist.

If you act in good faith within the scope below, we will not pursue legal action against you for your research, and we will not report you to law enforcement for it. If someone else brings an action about research we consider to be in good faith and in scope, we will say publicly that we consider it authorised.

In scope

• The SignalOS application and its API.
• Our public marketing site.

What we ask of you

• Use only accounts you own or have permission to test. Do not access, modify or keep anyone else's data — if you reach data that is not yours, stop and tell us what you saw so we can measure the exposure.
• Do not run denial-of-service tests, send spam, or use social engineering against our people or our customers.
• Do not use automated scanning that degrades service for other customers.
• Give us reasonable time to fix something before you publish it, and tell us when you plan to.

Out of scope

• Third-party services we depend on — report those to the service concerned.
• Findings from automated scanners with no demonstrated impact.
• Missing hardening headers or best-practice recommendations with no exploitable consequence, though we are still glad to hear about them.

The safe-harbour wording above states our intent in plain language. Counsel should turn it into something enforceable in the jurisdictions where we and our researchers sit, without narrowing what it promises.