Security
Found a hole? Send it here first.
Report it privately and give it time to be fixed. Everything below is what we will do with it.
- Report channel
- [email protected]
- First response
- Within five working days
- Public disclosure
- After a fix, by agreement
How to report
Private first, public after.
Send a private report to [email protected] with "Security disclosure" in the subject. Do not include private audio, transcripts, API keys, or user secrets unless we explicitly ask for a safer reproduction path.
Include what you did, what happened, what you expected, and the version or commit you were on. A reproduction beats a description. If you have a proof of concept, attach it.
What happens next
Three commitments, and no bounty.
You get a human reply
An acknowledgement within five working days that says whether we have reproduced it, not an automated ticket number.
You get credit if you want it
Named in the release note that carries the fix, or not, entirely as you prefer.
You do not get paid
There is no bug bounty. Please report because it helps protect operators and recorded people, not because a reward is implied.
Scope
What is and is not ours to fix.
In scope: the application, the worker, the API surface, the admin plane, the database policies, the compose files, and the launch scripts.
Not in scope: your reverse proxy, your host, your identity provider if you configure one, your firewall rules, your object storage bucket, and your backups. Self-hosting moves those to you, and this page cannot move them back.
Also not in scope: findings from an automated scanner with no demonstrated impact. Send the exploit, not the report.
Not a security issue?
If something is broken rather than exploitable, the runbooks are the faster path.