Vulnerability Disclosure Policy

1. Reporting

Send the vulnerability, with the steps to reproduce it, to security@mentagon.app. The same details are in our /.well-known/security.txt file.

2. Scope

mentagon.app and its subdomains, the API and the iOS and Android apps. Our processors’ own services are out of scope; please report those through their own channels.

3. Rules for good-faith research

• Use only your own accounts; never access, change or delete anyone else’s data.
• No tests that disrupt the service (load or denial-of-service), no social engineering, no physical attacks.
• Report what you find only to us, and do not disclose it until it is fixed, for at most 90 days.

We will not take legal action against good-faith researchers who follow these rules.

4. Our response

We confirm receipt within 3 business days and share our assessment and fix plan with you. There is no bounty programme for now; if you wish, we add your name to our thanks list.