Commitment
We take security seriously. If you find a vulnerability, we want to know so we can fix it before it causes harm. This page explains how to report it and what to expect.
Contact
Write to hola@diomu.es with the subject “Security”. Include a description, steps to reproduce, the impact you believe it has and, if you want, a proof of concept. Do not attach third-party personal data.
Scope
We are especially interested in:
- Authentication, session or 2FA flaws.
- Access to other people’s data through RLS or API failures.
- Remote code execution, injection or dangerous file uploads.
- Leaked secrets or credentials.
- Bypassing moderation or Nixo limits.
Out of scope
- Denial-of-service attacks or load testing.
- Social engineering, phishing or physical access.
- Vulnerabilities in third-party services such as Supabase or Cloudflare, which should be reported to them.
- Spam, mass brute force or automated scanning without permission.
- Issues that only affect old, unsupported browser versions.
Research rules
- Do not access data that is not yours, or store, copy or publish it.
- Do not interrupt the service or degrade other people’s experience.
- Do not use techniques that could harm people or infrastructure.
- Give us a reasonable time to fix the issue before publishing details.
- Do not extort, demand rewards or sell the finding.
What we will do
We will acknowledge receipt within around 3 business days and keep you informed. We will work on a fix and credit you where appropriate. We do not currently have a paid bug bounty programme.
Safe harbour
If you act in good faith, follow this page and cause no harm, we will not take legal action against you for the research. This safe harbour does not cover abuse, extortion, access to personal data or harm to third parties.
Disclosure
We will coordinate responsible disclosure with you. We prefer that you wait until the fix is deployed. If we do not respond within a reasonable time, you may escalate the case, but do not publish personal data or instructions that put others at risk.