Vulnerability disclosure

Found something? We want to hear it

FlowReader holds people’s reading. That includes what they’re interested in, what they highlighted, and what they saved and never told anyone about. It deserves proper protection, and we’d much rather hear about a weakness from you than from someone exploiting it.

About the reward, up front

This is a small operation. We cannot pay the kind of bounty a large company pays. We won’t pretend otherwise, or offer you a token amount that wastes your time.

For a valid, relevant report, we offer something modest. One year of FlowReader Pro, free. You also get credit in the release notes under any name you choose, or none if you’d rather stay anonymous. If that isn’t worth your time, we understand completely, and we’d still rather you told us.

  • One report, one reward. Duplicates go to whoever reported first, and we will tell you if yours was one.
  • The report has to be new, in scope, and demonstrate real impact. We decide that, and we will explain the reasoning either way.
  • We cannot issue rewards where sanctions or export-control law prevents it, or to anyone on a relevant sanctions list.
  • Any tax on the reward is yours. It is a year of a EUR 7.99 subscription, so this is unlikely to be interesting, but we are not going to imply otherwise.

What happens after you send it

  1. 01

    You report it privately

    Use the form on this page. Include the affected version and platform, what you did, what happened, and why it matters. Do not open a public issue, and do not post it anywhere else first.

  2. 02

    We acknowledge within five business days

    A person reads it and replies. If you have not heard anything in that window, assume it went astray and send it again before taking it anywhere public.

  3. 03

    We classify and fix

    We assess severity, agree a remediation timeline with you, and keep you updated as it moves. Reports involving credential theft or remote code execution are treated as urgent.

  4. 04

    We coordinate disclosure

    Once a fix has shipped and users have had a reasonable chance to update, you are free to write about it. We will credit you by whatever name you prefer, or not at all if you would rather stay anonymous.

In scope

  • The browser extensions for Chromium browsers and Firefox
  • The desktop application
  • The FlowReader website
  • The optional online services, such as sync, newsletter delivery, Monitors that run on our servers, and subscription handling
  • Anything that lets one account reach another account’s data
  • Anything that gets local reading data off a device without the user asking

Not in scope

Listed so you do not spend time on something we will close.

  • Findings from automated scanners with no demonstrated impact
  • Missing security headers or cookie flags with no exploitable consequence
  • Rate limiting or brute force on endpoints with no sensitive effect
  • Social engineering, phishing, or physical access to someone’s unlocked device
  • Denial of service, traffic flooding, or anything that degrades the service for real users
  • Vulnerabilities in third-party services we do not control. Report those to their owners
  • Reports that require a user to install a malicious build of FlowReader

Ground rules

Stay inside these and your research is authorised. The safe harbour below explains what that means in the terms that matter to you.

  • Use your own account and your own test data. Never access, modify or retain anyone else’s.
  • Stop as soon as you have demonstrated the issue. Do not pivot further into the system.
  • Do not run denial-of-service tests, or anything that degrades the service for other people.
  • Do not include production credentials or real user content in your report.
  • Give us a reasonable chance to fix it before writing publicly.

Safe harbour

The commitment below names the laws a researcher is exposed to. They are Norway’s straffeloven §§ 204–206, the US Computer Fraud and Abuse Act and DMCA § 1201, and the UK Computer Misuse Act 1990.

  • We authorise the security research described in the ground rules above. Access carried out within them is access with our permission. That is the point of saying so here rather than only promising not to complain about it later.
  • We will not bring or support a civil claim or a criminal complaint against you for research that stays inside those rules. That includes claims under Norway’s straffeloven §§ 204–206, the US Computer Fraud and Abuse Act and DMCA § 1201, and the UK Computer Misuse Act 1990.
  • If a third party takes action against you over research we authorised, tell us. We will confirm to them, in writing, that it was authorised.
  • If you break a rule by accident and tell us promptly, we will treat that as good faith. Tell us what you reached, what you did with it, and stop there.
  • We cannot waive the rights of anyone else. If your testing reaches a third party’s system or another user’s data, this safe harbour does not cover it. That is why the rules say to stop.

Report a vulnerability

This goes straight to the security mailbox, not to a public tracker and not to a support queue. Acknowledged within five business days.

Do not include credentials, access tokens, or real user content in this form. If a proof of concept needs them, say so and we will arrange a secure channel.

Used only to reply to this message.

Affected version and platform, the steps to reproduce it, what happens, and why it matters. Never include production credentials or anyone’s real content.

Spam check

This one check is run by Cloudflare. It sets no cookie and does not track you across sites.

No account needed, and nothing is stored on this site. The message is emailed, and that is all.