Responsible disclosure

We welcome reports from security researchers and anyone who finds a weakness in www.mule.sh, the Mule Portal or a system Mule runs. This policy explains how to report and what we commit to. Our machine-readable contact is at /.well-known/security.txt.

How to report

Email juastins@icloud.com with "Security" in the subject. Include:

• what you found and where (URL, system, component);
• steps to reproduce, and any proof of concept;
• the impact as you understand it;
• how we can reach you.

Reports in English, Dutch, French or German are fine.

What we commit to

• Acknowledge your report within 3 business days.
• Keep you informed while we investigate and fix it.
• Not take legal action against good-faith research that follows this policy.
• Credit you, if you wish, once the issue is fixed.

Please

• Test only against your own accounts and data. Do not access, change or delete other people's data.
• Do not run denial-of-service tests, social engineering, physical attacks or spam.
• Give us reasonable time to fix the issue before disclosing it publicly. We aim for 90 days or less.
• Stop and tell us if you reach personal data, client records or credentials.

Out of scope

Client systems hosted by others; reports from automated scanners without a demonstrated impact; missing best-practice headers with no exploit; issues in third-party services, which should go to that provider.

We do not run a paid bug bounty at this time.