Trust
Security & disclosure
We build software people trust with their messages, recipes and code, so we take security reports seriously. If you’ve found a vulnerability, please tell us privately and give us a chance to fix it before you share it.
How to report
- Preferred: open a private security advisory on the project’s GitHub repository: Morse, Mesh, Savorly or Incant.
- Or email hello@sigenticlabs.com with “Security report” in the subject.
Please include what you found, where, how to reproduce it, and the impact you think it has. Don’t include other people’s personal data.
Scope
- Savorly: the apps, savorly.cooking and its API.
- Morse: the apps, the protocol and its services, and morseapp.io. Morse is pre-release and makes no production-security claim yet, but protocol and cryptography reports are especially welcome.
- Mesh: the compiler, runtime, package manager and registry, and meshlang.dev.
- Incant: the engine, editor and project site.
- sigenticlabs.com.
What to expect
- We’ll acknowledge your report and keep you updated while we investigate and fix it.
- We’ll let you know when it’s fixed, and we’re happy to credit you publicly if you’d like.
- Please give us reasonable time to release a fix before disclosing the issue publicly.
We don’t currently run a paid bug bounty.
Safe harbor
If you research and report in good faith under this policy, we won’t pursue legal action against you. Good faith means you avoid privacy violations, data destruction and service disruption, you only access the minimum data needed to show the problem, and you don’t keep or share any data you come across.
Out of scope
- Denial-of-service and load testing.
- Social engineering, phishing or physical attacks.
- Spam, or findings that require a compromised device.
- Reports from automated scanners without a demonstrated impact.