Reporting a security problem

If you find a security problem in anything we make, please tell us. Effective November 13, 2026.

What this covers

Services we use but don’t run, such as our hosting and email providers, aren’t covered. Report problems in those to the company that runs them.

How to report

Email support@ganshiki.com and start the subject line with “Security” so we can find it quickly. Include:

  • what you found and where
  • the steps to reproduce it
  • what an attacker could do with it
  • the name you’d like to be credited under, if any

Send one problem per email. Please don’t attach other people’s data, even if you came across some.

What we’ll do

  • Reply within 3 business days to confirm we have your report.
  • Tell you whether we can reproduce the problem, and keep you updated while we fix it.
  • Tell you when it’s fixed.
  • Credit you publicly if you’d like. We won’t name you without your permission.

We don’t run a bug bounty, so we can’t pay for reports.

Ground rules

  • Test only with accounts you own, or have the owner’s permission to use.
  • If you reach data that isn’t yours, stop there. Don’t keep it, change it or share it, and tell us in your report.
  • Don’t run tests that slow down or interrupt the service for other people.
  • No spam, phishing or social engineering of our users or of us, and no physical attacks.
  • Keep the details private until we’ve fixed the problem or agreed a disclosure date with you.

Safe harbor

If you follow these rules in good faith, we won’t take legal action against you or report you to law enforcement for your research. If someone else takes action against you over research you did under this policy, we’ll make it known that we authorized it.

What we don’t treat as a vulnerability

  • Output from an automated scanner, with no demonstrated way to exploit it
  • A missing header or setting that is good practice, with no demonstrated way to exploit its absence
  • A report that a software version is out of date, with no working exploit

A machine-readable version of this contact is at /.well-known/security.txt.