Responsible disclosure

Security

Please report vulnerabilities privately and avoid accessing content that is not yours.

What to include

Describe the affected surface, reproduction steps, impact, and a safe way to verify the issue. Do not include access tokens, invitation tokens, thought content, or other people's personal data.

Safe testing

Use accounts and projects you control. Do not run denial-of-service tests, send unsolicited invitations, or retain data encountered accidentally.

Contact

Use the support option inside Thoughts and mark the message “Security”. A dedicated security mailbox will be published after inbound domain mail is activated.