Report a security problem

What we promise you

If your research follows the rules on this page, then, for the whole time you are looking and for the report you send us:

• We will not take you to court over it, and we will not report you to the police.
• We consider your testing authorized. If someone else complains about it — our hosting company, for example — we will say that.
• You do not have to sign anything, agree to stay quiet, or give us your real name before we will read your report.
• We will not publish your name, your handle, or your email address without asking you first.

Two limits, said plainly. First, we can only promise this for ourselves. We cannot promise it for our hosting company, our payment company, or a person whose data a bug happened to show you. Second, this covers looking and telling us. It does not cover using what you found to take data, money, or somebody's account.

What we do not promise

A response time. Most pages like this one promise a reply within a fixed number of hours. We are not going to publish a number that nobody is on call to meet. Demystif is run by one person; there is no security team, no rota, and no pager. If days go by in silence, the likely reason is that your email has not been read yet.

We would rather tell you that than post a number. A deadline you plan your disclosure around, that then passes with nothing happening, is worse for you than no deadline at all.

Money. There is no reward and no bug bounty. That is a decision, not an oversight. A paid program needs someone to sort, judge and argue about every report that comes in, and there is nobody here to do that. We would rather owe you nothing than owe you money we cannot handle. If we ever open a paid program, it will be announced on this page before anywhere else.

A thank-you page. There is not one yet, because nobody has been credited yet, and a page listing no one would tell you less than this sentence does. The credit itself is still yours: say in your email how you want to be named, and when the fix ships we will put that page up with your name on it. Saying no is fine too — we will not name you unless you ask.

What is in scope

• demystif.com and everything served from it: the pages, the API under /api/, and the sign-in with Google or Facebook.
• The payment flow, up to the point where it hands you over to Lemon Squeezy, the company that takes the payment.
• Our email and domain setup, as far as you can look at it from the outside without touching anyone's mailbox.

What we care about most: anything that hands one person's analysis to another, anything that unlocks a paid report without paying, and anything that gets our AI to give up its instructions or somebody else's document.

What is out of scope

These are the rules of engagement. Break them and the promise above stops applying.

• Other people's data.If a bug shows you an account or an analysis that is not yours, stop right there. One record is enough to prove the bug. Do not collect more, do not save it, do not share it. An analysis here can quote lines from a real person's medical bill.
• Anything that degrades the site for other people: denial of service, load or stress testing, password guessing at volume, or a scanner turned up to full speed.
• Social engineering of us, of our suppliers, or of our users. That includes phishing, phone calls, and fake support requests. Same for physical access to anything.
• Systems that are not ours. Lemon Squeezy, Anthropic, Cloudflare, Hetzner, Zoho, Google, and Facebook run their own programs — report to them, not to us. Our subprocessors page lists who is who.
• Testing with a real bill that belongs to someone else. Make one up. You do not need real data to find a bug in how we handle it.
• Findings with no attack behind them: a missing header, a scanner printout, a software version, or advice to turn something on. Show us what an attacker gets and we will read it carefully.

What to put in the report

• the address or endpoint, and what you sent to it;
• the steps, in order, so we can repeat them;
• what an attacker gets out of it — this is the part we read first;
• when you tested, with your time zone, and the IP address you tested from if you know it. It lets us find your traffic in our logs and tell it apart from somebody else's.

Please keep real personal data out of the report itself. If you have to show a record to make the point, cut it down to the smallest piece that proves it.

What happens after you send it

We read it, try to reproduce it, and fix what is real. If your report shows that someone's personal data was exposed, it also starts our incident process: Brazilian data protection law can require us to tell the people affected and the national authority. We may come back to you with questions for that. Answering them is your choice.

About publishing.We ask you to hold the details until the fix is out, or for 90 days from the day you emailed us, whichever comes first. Silence from us does not stretch that window — we did not promise to answer, so it would not be fair to make your clock depend on ours. Whatever you publish, please leave other people's data out of it.

The machine-readable version

The same contact and a link to this page are published at /.well-known/security.txt, in the format of RFC 9116. It carries an Expires date, which is a review date: after it passes, treat what the file says as possibly out of date, and check this page instead.

If anything here conflicts with our Terms of Use, this page is the one we will honor for security research. What we do with the data we hold is a different subject, and it is in our Privacy Policy.