How to report
Email us directly. Please don't open a public issue, post on social media, or share details with third parties until we've had a chance to fix the problem.
We'll acknowledge your report within 48 hours and keep you informed while we investigate and fix the issue. A machine-readable version of this policy lives at /.well-known/security.txt.
What to include
- The affected component, endpoint, or page
- Steps to reproduce the issue
- The impact you believe it has, and a proof of concept if you have one
- How we can reach you for follow-up questions
Responsible disclosure
We welcome good-faith security research, within these limits:
- Only interact with accounts and servers that belong to you
- Never access, modify, or delete data that isn't yours — if a flaw exposes someone else's data, report it without exploring further
- No denial-of-service testing, resource exhaustion, or spam
- Don't take a vulnerability further than needed to demonstrate it exists
- Give us reasonable time to fix the issue before any public disclosure
If you follow these rules in good faith, we will not pursue legal action over your research, and we're happy to credit you publicly once the issue is fixed — just tell us how you'd like to be named. We don't currently run a paid bug bounty programme.
Regular bugs and support
Found a bug that isn't a security issue, or need help with your account? Contact support@baremeta.cloud. To report abuse originating from our network, contact abuse@baremeta.cloud.
Looking for guidance on securing your own server? See Securing your server in our docs.