Responsible Security Disclosure

Use the product-specific security contact when one is published. Otherwise, use the Nolote security reporting channel listed below.

Do not include passwords, private keys, access tokens, raw personal data, payment-card data, or a complete customer dataset in the initial message. A security team member can provide a protected exchange method when additional evidence is required.

Use the verified security contact published in Nolote’s security.txt file:

https://www.nolote.com/.well-known/security.txt

A useful report contains:

• A clear description of the potential issue
• The affected Nolote or product domain, application, version, endpoint, or component
• Safe steps to reproduce
• The observed and expected behavior
• Potential impact
• Minimal redacted evidence
• Whether any user or customer data was accessed
• Your preferred contact method
• Any disclosure deadline you are considering

Please send one issue per report when practical. Explain related chains clearly if multiple findings combine into one material impact.

Researchers should:

• Make a reasonable effort to avoid privacy violations and data exposure
• Use accounts and systems they own or are authorized to test
• Stop after confirming the minimum evidence required
• Avoid persistence, lateral movement, and privilege expansion beyond the issue
• Avoid changing, deleting, or corrupting data
• Avoid denial of service, load testing, resource exhaustion, and traffic amplification
• Avoid phishing, social engineering, physical intrusion, and employee targeting
• Avoid accessing another person’s private content
• Keep the issue confidential while Nolote investigates and coordinates remediation
• Comply with applicable law

If sensitive data is encountered unexpectedly, stop, do not copy more, and explain what was observed.

• Denial-of-service or volumetric testing
• Automated scanning that creates material load
• Credential stuffing, password spraying, or brute force
• Social engineering or phishing
• Physical security testing
• Third-party services and infrastructure not controlled by Nolote
• App-store, cloud-provider, payment-provider, messaging-provider, or open-source issues that do not result from Nolote’s implementation
• Self-XSS or issues requiring a user to attack themselves without another meaningful impact
• Missing security headers without a demonstrated risk
• Version disclosure without exploitability
• Spam, rate-limit, or abuse reports without a reproducible product impact
• Product behavior explicitly documented as a limitation
• Reports based solely on automated-tool output without validation

A listed exclusion does not mean Nolote is uninterested. It means the researcher should contact the team before conducting higher-risk testing.

Nolote’s process is to:

1. 01Acknowledge a complete report through the published channel.
2. 02Triage scope, reproducibility, severity, and affected product.
3. 03Request a secure exchange route when more evidence is needed.
4. 04Coordinate investigation with the responsible product and platform owners.
5. 05Develop, validate, and deploy an appropriate remediation.
6. 06Communicate material status changes when possible.
7. 07Coordinate disclosure timing based on user risk and remediation progress.
8. 08Credit the researcher when requested, appropriate, and legally permitted.

Please give Nolote a reasonable opportunity to investigate and remediate before public disclosure.

Nolote may ask to delay publication when users remain at material risk or a coordinated dependency fix is still in progress. Researchers retain responsibility for their own legal obligations, and Nolote cannot guarantee a reward, credit, or specific timeline.

Nolote does not currently publish a standing monetary bug-bounty program. Recognition or discretionary rewards, if any, are determined case by case and are not guaranteed.

Material security updates are published through the affected product’s official status, support, release, or security channel. This disclosure page is not a live incident-status page.