Skip to content
Sign inStart my free trial

Vulnerability Disclosure Policy

If you think you've found a security vulnerability in mailfloss, we want to hear about it. This page explains how to report it and what to expect from us.

Last updated: November 15, 2026

How to report

Email [email protected] with:

  • The affected URL, endpoint or component.
  • The type of issue and its potential impact.
  • Step-by-step instructions to reproduce it. A proof of concept, request and response samples, or screenshots help.

Include the full details in your first email. You don't need to wait for us to confirm before you share them.

What we commit to

  • We aim to reply within 5 business days.
  • We'll tell you whether we can reproduce the issue, and keep you updated while we fix valid issues.
  • We treat good-faith research that follows this policy as authorized, and we won't pursue legal action over it. For that research, this policy overrides the security-testing restrictions in our Terms of Use and Developer Terms. It covers systems mailfloss controls, not the third-party services listed below.

Please don't

  • Access, change or delete data that isn't yours. Use your own test account, and stop once you've shown the issue.
  • Run denial-of-service, spam or high-volume automated tests.
  • Use social engineering or phishing, or physically test our staff, offices or vendors.
  • Test third-party services we integrate with, such as HubSpot, Mailchimp or Klaviyo. Report those issues to the vendor.
  • Disclose the issue publicly before we've had a reasonable chance to fix it.

Usually out of scope

Unless you can show a real, exploitable impact, we usually treat these as out of scope:

  • Reports straight from an automated scanner, with no proof of concept.
  • Missing security headers or cookie flags, and banner or version disclosure.
  • SPF, DKIM or DMARC settings on domains that don't send mail.
  • Clickjacking on pages with no sensitive actions.
  • Self-XSS, logout CSRF, or missing rate limits on non-authentication endpoints.
  • Issues that need a compromised device or browser.
  • Leaked credentials that came from malware on a user's own device.

Rewards

mailfloss doesn't run a paid bug bounty program, and we don't pay for reports. With your permission, we're happy to thank you publicly for a valid finding.