If you discover a security vulnerability in securememo.app, please report it responsibly.

• Email: timo.heimonen@proton.me
• Use a descriptive subject line such as Security Vulnerability Report.
• Do not disclose the vulnerability publicly until there has been time to investigate and mitigate it.

• Clear vulnerability description.
• Steps to reproduce.
• Potential impact.
• Proof-of-concept details, if available.
• Your preferred contact information for follow-up.

Only the current main branch is supported. The current service target is the Go + SQLite application in this repository.

• Memo content is encrypted client-side before upload.
• The server stores only encrypted memo payloads and metadata needed for expiry and deletion.
• Passwords are generated in the browser and are never sent to the server.
• Memos are deleted after successful read confirmation or expiry.
• The service applies strict security headers and validates request size, method, origin, memo IDs, and payload formats.
• Rate-limit identities and counters are kept only in bounded process memory and reset on restart.

There is no formal bug bounty program at this time.

This policy may be updated periodically.

Last updated: May 10, 2026