Report a security vulnerability

Last updated: October 2026 · Coordinated vulnerability disclosure policy

Found a security vulnerability in Audicap? Thank you for reporting it to us. We review every report and fix confirmed vulnerabilities as quickly as we can.

1. How to report

Please include:

• the affected component and version (app version, macOS or Windows, browser extension, website)
• a description of the vulnerability and its possible impact
• the steps to reproduce it, ideally with an example or screenshot
• how we can reach you with questions

Please do not send real recordings, transcripts or other people's personal data.

2. Scope

This policy covers:

• the Audicap desktop app for macOS and Windows
• the browser extension “Audicap Meet Companion”
• the website audicap.app and our licence and update server api.audicap.app

Out of scope are third-party services you connect to Audicap (such as cloud AI providers, calendars or payment services), attacks on availability (denial of service), social engineering and physical attacks. Please report vulnerabilities in third-party services to those providers directly.

3. What you can expect from us

• We confirm receipt of your report within five business days.
• You get an initial assessment within 30 days, and we keep you updated after that.
• We agree on the time of publication with you. Our goal is to fix confirmed vulnerabilities within 90 days.
• We list fixed security vulnerabilities in the release notes and, if you like, credit you by name.

4. Safe harbour for good-faith research

If you act in good faith and follow these rules, we will not take legal action against you and consider your research authorised:

• You test only with your own accounts, devices and data.
• You access other people's data only as far as needed to demonstrate the vulnerability, and you neither keep nor share it.
• You do not disrupt our services or other users.
• You report the vulnerability promptly and keep it confidential until it is fixed or we have agreed on publication.

We cannot waive the rights of third parties. If you are unsure whether something is allowed, ask us first at security@audicap.app.

5. No bounties

We do not run a bug bounty programme and do not pay rewards for reports.

This policy is also available in machine-readable form: /.well-known/security.txt