Found a flaw. Tell us first.

This policy covers:

• margin.computer and www.margin.computer, this website, and the waitlist form behind it at waitlist.margin.computer.
• api.margin.computer, the Margin service the extension talks to.
• errors.margin.computer, the error tracker we run on our own server.
• The Margin Chrome extension, as published in the Chrome Web Store.

Anything not listed here is out of scope. That includes services Margin uses but doesn't run, such as Todoist, Google sign-in, your LMS, Lemon Squeezy (the merchant of record), Cloudflare, Hetzner and Zoho Mail. Report problems in those to their owners. Reports from automated scanners with no demonstrated impact are out of scope too. If you aren't sure whether something is covered, ask before you test it.

Email privacy@margin.computer with “Security” in the subject. Tell us:

• what is affected: the URL, the API endpoint, or the extension version;
• the steps to reproduce it, and what an attacker could do with it;
• how to reach you, and whether you'd like to be credited.

Don't put anyone else's personal data in a report. We don't publish a PGP key. The same details are in machine-readable form at /.well-known/security.txt.

• Act in good faith and follow this policy.
• Report a vulnerability promptly once you've found it.
• Test only what's listed in scope. Leave the services above alone; their own policies apply.
• Test only with accounts you own, or with the account holder's explicit permission.
• Access no more data than you need to show the problem. If you reach anyone else's data, stop, don't keep or share it, and report straight away.
• Don't change or delete data, and don't degrade the service for anyone: no denial-of-service, no load or volume testing, no spam.
• No social engineering or phishing of Margin, its readers or its providers, and no physical attacks.
• Give us a reasonable time to fix the problem, at least 90 days from your report, before you disclose it publicly.
• No extortion. Don't make a fix, or your silence, conditional on payment.

• We acknowledge your report within 3 business days.
• We work with you to understand and confirm it, and tell you how it's going.
• We fix confirmed vulnerabilities as quickly as we reasonably can, within our operational constraints.
• If you want credit, we credit you once the fix is out.
• We extend the safe harbor below to research that follows this policy.

We don't run a paid bug bounty.

When you research vulnerabilities in line with this policy, we consider that research to be:

• authorized under applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
• authorized under relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;
• exempt from the restrictions in our terms of service that would interfere with conducting security research, and we waive those restrictions on a limited basis; and
• lawful, helpful to the overall security of the internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

If at any time you are unsure whether your research is consistent with this policy, report what you have through the address above before going any further.

This safe harbor applies only to legal claims under Margin's control. It does not bind independent third parties, including the services listed as out of scope above.

Marginalia.
Adapted from the disclose.io Core Terms, released under CC0 1.0.