Found a hole?Tell us first.

How to report

Email security@singulr.tech. For repositories that have private vulnerability reporting switched on, you can also use “Report a vulnerability” on the repository’s Security tab. Please don’t open a public issue for a vulnerability.

Helpful things to include: the project and version, what you found, how to reproduce it, and what someone could do with it. Short is fine. A proof of concept helps. You can also use the form further down this page.

What’s in scope

• Our open source projects: Wavvy, Shiny Fishstick, LinkUp, Wiggle and XRisk.
• This website.

Out of scope: third-party services (Google, GitHub and so on), social engineering or physical attacks, denial of service, and scanner output with no demonstrated impact.

Ground rules

• Test only against your own accounts, devices and data.
• Don’t access, change or share other people’s data. If you run into some, stop and tell us.
• Give us a reasonable chance to fix the problem before you make it public.

What we’ll do

• Acknowledge your report within three working days.
• Keep you updated, and tell you when it’s fixed.
• Agree a disclosure date with you. Most fixes should land well within 90 days, and if one will take longer we’ll tell you why.
• Credit you in the release notes if you’d like that.
• Not take action against good-faith research that follows these rules.

Known limits

Some limits are known and documented, so you don’t need to report them:

• Wavvy stores the details you give it unencrypted in your browser profile, and doesn’t sync them. Anyone with access to that profile can read them.
• XRisk is a safety layer, not a replacement for hardening your infrastructure. Treat its decisions as one control among several.
• LinkUp is only as safe as the devices at each end. Pair only with devices you trust.

Bounties

We don’t run a paid bounty programme yet. What we can offer is a thank-you, credit and a fast fix.