Reporting a vulnerability
Email gajanansr8@gmail.com. Include what you found, how to reproduce it, and how you would like to be credited. We will acknowledge within three working days and tell you what we intend to do.
We will not take legal action against anyone who reports in good faith, gives us reasonable time before disclosing, and does not access, modify or destroy data that is not theirs.
There is no bug bounty. We are pre-launch and it would be dishonest to imply a budget that does not exist.
What this site stores
One thing: the email address you type into the waitlist form, with the time you submitted it and which form you used. Nothing else — no cookies, no session, no account, no tracking pixel, and no advertising network.
What the endpoint does
- Rejects anything that is not a plausible email address.
- Rate limits submissions per address block.
- Carries a honeypot field: a submission that fills it receives an ordinary success response and is stored nowhere.
- Returns no internal detail on failure. Errors are logged server-side only.
Known limitations
We would rather write these down than have you find them. The rate limiter keys on a request header that a determined caller can rotate, and it holds state per server instance rather than centrally, so it is a courtesy rather than a defence. A durable limiter is planned and tracked.