Reporting security issues

Found a vulnerability in CrowOn? Report it on the Help Center's security page.

• Report a vulnerability — The form on support.crowon.app
• security.txt — Contacts and policy (RFC 9116)

Scope

crowon.app, support.crowon.app, the CrowOn iPhone app, and the CrowOn server they use (/api).

Out of scope: accessing other people's accounts or data, denial of service, sending spam, social engineering, physical attacks, and services run by other companies.

Rules for testing

• Use only test accounts you made yourself.
• If you see someone else's information, stop, don't keep it, and report it right away.
• Don't publish the issue until it's fixed.
• CrowOn takes no legal action over good-faith research and reports that follow these rules.

After you report

• We read it, reply, and tell you what we found and when it will be fixed.
• We tell you when it's fixed and, if you like, thank you by name.
• There is no bug bounty at the moment.