SECURITY

Security & vulnerability disclosure

One address, one policy, stated response times. Last reviewed 7 August 2026.

QUICK ANSWER

Report security issues to [email protected]. We reply within 72 hours and give a triage verdict within 7 days. Good-faith research under the rules on this page carries safe harbour. Clipy does not currently hold SOC 2, ISO 27001, or an independent penetration-test report, and we do not run a paid bug bounty.

Where to report

[email protected]. Machine-readable contact details live at /.well-known/security.txt, per RFC 9116.

How fast we answer

First human reply within 72 hours. A triage verdict — confirmed, duplicate, or not-a-vuln — within 7 days.

Safe harbour

Report in good faith under the rules below and we will not pursue legal action or ask your host to suspend you.

What we do not run

No paid bug bounty. We say so plainly rather than implying one and declining later.

How to report

  • Email security@clipy.online with steps to reproduce, affected URLs, and the impact you believe it has.
  • Include a proof of concept if you have one. Screenshots and a short Clipy recording both work.
  • Tell us if you intend to publish, and when. We will ask for time only if a fix genuinely needs it.
  • You may report anonymously. We will still confirm receipt on the thread you opened.

Rules for good-faith research

  • Test against your own account and your own recordings. Do not access anyone else’s data.
  • Stop at proof. Do not exfiltrate data, pivot deeper, or persist access once you can demonstrate an issue.
  • No denial of service, no load or stress testing, no spam or social engineering of our team or users.
  • Do not modify or delete data that is not yours. If you cannot prove the issue without doing so, describe it and we will reproduce it ourselves.

What we commit to

  • A human reply within 72 hours of your report.
  • A triage verdict within 7 days: confirmed, duplicate, already known, or not a vulnerability, with reasoning either way.
  • Critical and high-severity fixes shipped within 30 days, or a written explanation of what is blocking us.
  • Credit on this page if you want it, and no credit if you would rather stay anonymous.
  • No legal action, and no request to your ISP or employer, for research that follows the rules above.

Our current posture, stated plainly

We would rather you learn this here than infer it from an empty compliance page. Clipy is a small, founder-led product, and the honest position today is:

  • No SOC 2, ISO 27001, or HIPAA attestation. None is in progress. If your procurement process requires one, Clipy will not pass it yet.
  • No independent penetration test published. We have not commissioned one.
  • No paid bug bounty. We say thank you, we credit you, and we fix it. We do not pay.
  • GDPR-aligned practices, not a certification. Data minimisation, export, and hard deletion are implemented and documented field by field on /trust. No third party has audited that.

What we do have: no data sale, no ad networks, no training any model on your recordings, redaction-filtered crash diagnostics, first-party HttpOnly cookies only, and account deletion that really deletes. Each of those is itemised on /trust.

Out of scope

  • Findings from automated scanners with no demonstrated impact.
  • Missing hardening headers or a low SSL-test grade, absent a working exploit.
  • Reports about our email SPF/DKIM/DMARC posture that do not show a deliverable spoof.
  • Social engineering, physical attacks, and anything requiring a compromised device the victim already lost.
  • Vulnerabilities in third-party services we consume, which belong to those vendors’ own programmes.

Machine-readable

An RFC 9116 record is served at /.well-known/security.txt. It is generated rather than checked in, so its Expires field stays current instead of quietly going stale.