Reporting a security problem

Write to security@sternway.dev with what you found, the version (Settings › About), your system, and the steps that show it. Please don't open a public issue or post details before a fix is out.

What happens next

• We reply to say the report arrived, usually within a few days.
• We tell you whether we can reproduce it, and keep you posted until it is fixed.
• The fix ships in the next release, and its notes say what was fixed. With your permission, the notes thank you by name.

What's in scope

The desktop and Android apps, the sync server, the licence portal, and this website. Not in scope: denial of service by flooding, social engineering, and problems in a self-hosted server's own setup (its reverse proxy, its TLS certificate).

There is no bug bounty yet. Sternway has not had an outside security review; until one is published, the site makes no claim beyond what each feature's documentation describes.

Machine-readable contact: /.well-known/security.txt.