If you discover a security vulnerability in securememo.app, please report it responsibly.

• Email: timo.heimonen@proton.me
• Use a descriptive subject line such as Security Vulnerability Report.
• Do not disclose the vulnerability publicly until there has been time to investigate and mitigate it.

• Clear vulnerability description.
• Steps to reproduce.
• Potential impact.
• Proof-of-concept details, if available.
• Your preferred contact information for follow-up.

Only the current main branch is supported. The current service target is the Go + SQLite application in this repository.

• Memo content is encrypted client-side before upload.
• The server stores only encrypted memo payloads and metadata needed for expiry and deletion.
• Passwords are generated in the browser and are never sent to the server.
• Memos are deleted after successful read confirmation or expiry.
• The service applies strict security headers and validates request size, method, origin, memo IDs, and payload formats.
• Rate limiting is stored locally in SQLite.

There is no formal bug bounty program at this time.

This policy may be updated periodically.

Last updated: May 10, 2026