Reporting a vulnerability

Write to [email protected] describing the issue, the steps to reproduce it and its impact. We acknowledge receipt within 3 business days, keep you informed of the fix and credit you publicly if you wish. The contact is also published in the standard format at /.well-known/security.txt (RFC 9116).

What we ask

• Test only with your own account, without accessing or modifying other customers' data.
• No denial of service, spam, social engineering or physical attacks.
• Give us a reasonable delay (90 days at most) to fix the issue before any publication.

Research carried out in good faith within this framework will not lead to any legal action on our part.

How the platform is protected

• All traffic is encrypted (HTTPS, HSTS, TLS 1.2 minimum) and goes through an encrypted Cloudflare tunnel: the application only listens locally and cannot be reached through any port open to the Internet.
• Passwords are stored as irreversible hashes; API keys are stored hashed (SHA-256) and shown only once.
• Two-factor authentication (TOTP) is available for every account, with single-use recovery codes.
• Cross-site request forgery (CSRF) protection, sign-in rate limiting, a strict content security policy (CSP) and no third-party scripts on the site.
• Payments are processed by Stripe: no card data ever goes through our servers.
• The collector never interacts with attacker infrastructure: it only reads research publications.