Security & Responsible Disclosure
We welcome reports from researchers and ethical hackers who help us protect our users. If you find an issue, please report it responsibly so we can fix it quickly.
security@scubamail.ioWhat's in scope
Includes, but is not limited to:
Scubamail web application
API and backend services
Authentication and authorisation flows
Data handling and privacy-related functionality
How to report a vulnerability
Send your findings to security@scubamail.io and include the following.
Clear description
What is the vulnerability and what could an attacker do with it?
Steps to reproduce
Walk us through exactly how to trigger the issue.
Affected URL or endpoint
The specific path, API route, or feature that is affected.
Proof of concept
Screenshots, video, or a minimal PoC if applicable.
Our commitment to you
- We will acknowledge your report within 48 hours.
- We will keep you informed as we work on a fix.
- We will not take legal action against good-faith disclosure.
- We will credit researchers who wish to be acknowledged.