Security

Reporting a vulnerability

Please report privately, by email, to the security address below. You do not need an account on any platform. Do not open a public issue for a security problem.

Include what you found, where, how to reproduce it (ideally with a synthetic file) and the impact you believe it has. Never send a real personal document.

What to expect

• We aim to acknowledge a report within 3 business days.
• We aim to give an initial assessment within 10 business days.
• We aim to fix or mitigate critical and high issues within 30 days of triage where feasible.
• We will tell you honestly if we disagree that something is a vulnerability, and why.

These are targets, not guarantees.

Scope

In scope: the site, the processing code and the server API. Out of scope: a flaw inside a browser engine itself, and automated scanner output with no demonstrated impact.

More detail

The threat model and the security header policy are published with the source code. Abuse and takedown reports go to the abuse address on the contact page.