Vulnerability Disclosure Policy
We welcome reports from security researchers and users who find a vulnerability in Mailistix. This policy explains how to report one, what you may and may not do while researching, and what you can expect from us.
1. Scope
In scope:
- the Mailistix desktop application for macOS and Windows, latest released version;
- the Mailistix Cloud Services operated by us, that is the server functions and interfaces that the application calls;
mailistix.comand its subdomains operated by us.
Out of scope:
- services operated by third parties (for example Google, Microsoft, Supabase's own platform, Polar, Cloudflare, Sentry, PostHog). Report those to the respective provider;
- findings that need physical access to an unlocked device, a jailbroken or rooted device, or an already compromised operating-system account;
- denial-of-service tests, load tests, spam, social engineering and physical attacks;
- reports from automated scanners without a demonstrated impact; missing best-practice headers without a concrete exploit; self-XSS; clickjacking on pages without sensitive actions; rate-limit observations without impact.
2. How to report
Email legal@mailistix.com with a subject that starts with Security:, in English or German. Our security.txt lists the same contact. Please include:
- the affected component (desktop app with operating system and version, or the endpoint);
- the impact and the steps or a proof of concept to reproduce it;
- whether you believe it is being exploited;
- how we can contact you.
Do not include other people's emails, passwords or tokens. If your report needs sensitive material, tell us and we will agree on a secure way to share it.
3. Rules for research
While researching you must:
- only use accounts and mailboxes that you own or are explicitly authorized to use;
- not access, copy, change or delete data that is not yours; if you access such data by accident, stop, do not keep it, and tell us;
- not degrade the service for others (no denial-of-service, no mass automation, no brute force against other users' accounts);
- not use the AI Features to extract other users' data or to attack third parties;
- not exploit a finding beyond what is necessary to demonstrate it;
- give us reasonable time to fix the problem before you disclose it (we suggest 90 days, or earlier by agreement), and coordinate the publication with us.
4. Safe harbor
If you act in good faith and follow this policy, we will consider your research authorized, will not pursue civil action against you and will not file a complaint with law enforcement for it, and we will not invoke anti-circumvention or anti-reverse-engineering clauses of our Terms or EULA against you for that research. If a third party takes legal action against you for research that complied with this policy, we will make it known that your actions were authorized by us. This safe harbor does not cover activities that violate the law, and we cannot authorize testing of third-party systems.
5. What you can expect from us
- We acknowledge your report within 5 working days.
- We keep you informed about our assessment and the fix.
- We credit you in our release notes if you wish.
- We do not share your identity with third parties without your consent, unless the law requires it.
- If the vulnerability lies in a component of a third party, we may pass the technical details on to that third party so that it can fix it.
- Where the law requires it, in particular Article 14 of the EU Cyber Resilience Act (Regulation (EU) 2024/2847), we report actively exploited vulnerabilities to the competent authorities (the coordinating CSIRT and ENISA).
- We use the personal data in your report only to handle the report and the fix, as described in our Privacy Policy.
- We do not currently run a paid bug bounty program.
6. Security incidents affecting your data
If you are a Mailistix user and believe your account or data has been compromised, contact legal@mailistix.com immediately. How we handle personal-data breaches is described in our Privacy Policy.