Security

Report a vulnerability

Write to hello@out-box.dev with steps to reproduce, impact and your contact. We acknowledge within 3 business days and keep you updated until it is fixed. If you want, we credit you publicly.

• Test only with your own accounts and do not access, modify or delete other people's data.
• No denial-of-service testing, spam or social engineering.
• Give us a reasonable window (90 days) to fix before disclosing.

If you follow these rules, we will not pursue legal action over your research. We do not currently run a bug bounty.

How we protect the service

• HTTPS everywhere, with HSTS and a strict Content Security Policy in the app.
• Published pages run in a sandboxed iframe with an opaque origin, isolated from the Outbox session.
• Salted password hashes; API keys stored only as hashes, with scopes and revocation.
• Optional MFA with step-up confirmation for sensitive actions such as deleting the account.
• Login rate limits per IP and per account, and bot protection at signup.
• Audit log of account and admin actions, with truncated IPs.
• Infrastructure on Cloudflare; payments processed by Lemon Squeezy (we never see cards).

security.txt

Our contact is published at /.well-known/security.txt per RFC 9116.