Details

Thank you for your work in helping keep Standard Notes safe and secure. If you believe you've found a security issue in our product, we encourage you to notify us. We welcome working with you to resolve the issue promptly.

We are mostly interested in vulnerabilities related to our client application and syncing server.

Our client application can be downloaded from our website, or accessed via app.standardnotes.org. Its source code is also available. Our syncing server can be accessed via sync.standardnotes.org. It is the server the clients interact with for authentication and user data.

Issues related to our website (standardnotes.org) are welcome but not as interesting as issues related to the above.

Disclosure Policy

Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party. We may publicly disclose the issue before resolving it, if appropriate.
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

In-scope

Security issues in any current release of Standard Notes. Our product downloads are available on our homepage at https://standardnotes.com, and our source code is available at https://github.com/standardnotes.
Account enumeration issues, such as the ability to determine whether an account exists for a given email. This excludes information gained from attempting to register the account.

Exclusions

The following bug classes are out-of scope:

Bugs that are already reported on any of Standard Notes' issue trackers (https://github.com/standardnotes), or that we already know of.
Issues in an upstream software dependency (ex: Electron, React Native) which are already reported to the upstream maintainer.
Attacks requiring physical access to a user's device.
Self-XSS
Issues related to software or protocols not under SN's control
Vulnerabilities in outdated versions of Standard Notes
Missing security best practices that do not directly lead to a vulnerability
Issues that do not have any impact on the general public

While researching, we'd like to ask you to refrain from:

Denial of service
Spamming
Social engineering (including phishing) of Standard Notes' staff or contractors
Any physical attempts against Standard Notes' property or data centers

Thank you for helping keep Standard Notes secure!

Disclosure Policy

Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.

Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party. We may publicly disclose the issue before resolving it, if appropriate.

Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

In-scope

Security issues in any current release of Standard Notes. Our product downloads are available on our homepage at https://standardnotes.com, and our source code is available at https://github.com/standardnotes.

Account enumeration issues, such as the ability to determine whether an account exists for a given email. This excludes information gained from attempting to register the account.

Exclusions

The following bug classes are out-of scope:

Bugs that are already reported on any of Standard Notes' issue trackers (https://github.com/standardnotes), or that we already know of.

Issues in an upstream software dependency (ex: Electron, React Native) which are already reported to the upstream maintainer.

Attacks requiring physical access to a user's device.

Self-XSS

Issues related to software or protocols not under SN's control

Vulnerabilities in outdated versions of Standard Notes

Missing security best practices that do not directly lead to a vulnerability

Issues that do not have any impact on the general public

While researching, we'd like to ask you to refrain from:

Denial of service

Spamming

Social engineering (including phishing) of Standard Notes' staff or contractors

Any physical attempts against Standard Notes' property or data centers

Thank you for helping keep Standard Notes secure!