Reporting a vulnerability
Please use GitHub's private vulnerability reporting:
Open a private security advisory →
Include the version or commit, a description of the issue, and a minimal reproduction. Do not open a public issue for a vulnerability. We aim to acknowledge a report within a few days and to keep you informed while it is investigated.
The same channel is used for privacy and legal requests; mark the report so it reaches the right place.
Supported versions
The main branch is the supported version. Tagged releases
are supported for the lifetime of their release branch. If you run an older
fork or a modified deployment, update it before reporting an issue that may
already be fixed.
In scope
- the browser client, editor and local database layer;
- the sync engine and the Supabase adapter;
- the Postgres schema, row-level security policies and database
functions in
supabase/migrations/; - public share links, including password, expiry and revocation handling;
- the service worker and the PWA install path;
- the website's own code and configuration.
Out of scope
- vulnerabilities in a self-hosted Supabase deployment that are not caused by this repository's migrations or client code;
- reports that require a compromised browser profile or physical device access;
- denial of service against your own self-hosted instance;
- social engineering, phishing or physical attacks;
- missing hardening headers with no demonstrated impact.
Safe harbour
We support good-faith security research. If you act in good faith, avoid privacy violations, data destruction and service disruption, and give us a reasonable chance to fix the issue before disclosure, we will not pursue legal action or report you to law enforcement for that research. Coordinate public disclosure with us.
What we do
- No server-side note store on the hosted app, so there is no central database of notes to breach.
- Row-level security on every synced table, plus ownership checks on share links and attachment quotas.
- HTTPS everywhere, with response hardening headers and a report-only content security policy.
- Open source under AGPL-3.0, with CI and CodeQL on the repository, plus Dependabot security alerts.
- No analytics, advertising or third-party scripts in the app or on the site.
- Breach response. If a breach affecting personal data occurs, we will notify affected users and the relevant authority as the law requires.
No bug bounty
This is an individual open-source project with no paid bounty programme. We are happy to credit a reporter in the release notes if they wish.
Contact
Security reports: private advisory. The full policy is also in SECURITY.md in the repository.