Report a vulnerability

Where to report

Email security@nemuqu.com, in English. Do not report security issues in public issues, social media or support tickets. If the report needs an attachment with sensitive content, say so in a first message and we will agree a way to send it.

What to include

• The affected page, endpoint or feature, and when you observed it.
• Steps to reproduce, using your own test account and synthetic data.
• What you expected, what happened, and the security impact you believe it has.
• Any tokens, cookies or personal data redacted from logs and screenshots.

Scope

In scope:

• nemuqu.com and its pages.
• The NEMUQU application and the API behind it, reached through nemuqu.com.
• The security.txt file and the email flows NEMUQU sends (verification, invitations, password resets, privacy requests).

Out of scope:

• Systems run by our providers, such as hosting, storage, email and payment services. They are listed on Subprocessors; report to them directly.
• Any customer's systems, data or connected tools, including destinations a customer configures for delivery.
• Findings that need physical access, social engineering of people, or a compromised device.
• Missing best-practice headers or banner disclosures without a demonstrated security impact, and volumetric denial of service.

How to test

• Use only accounts and organizations you created yourself, and only synthetic data.
• Do not access, change or delete another organization's data. If you reach it by accident, stop, tell us, and delete your copy.
• Do not run denial-of-service, load, spam or brute-force tests, and do not degrade the service for anyone else.
• Stop at the point where you have shown the problem, rather than proving how far it goes.
• Do not upload real malware or real incident evidence to test parsers; use harmless samples.

This policy does not authorize testing beyond these rules, or of anything out of scope. It does not grant access to customer data or permission to test third-party infrastructure.

What happens next

• We acknowledge your report and keep you updated while we investigate.
• We may ask questions to reproduce the issue.
• When it is fixed, we tell you.
• We do not commit to a response deadline, offer no bug bounty and no reward of any kind, and are not a CVE numbering authority.

Disclosure

Please give us a reasonable opportunity to fix the issue before describing it publicly, and coordinate the timing with us.

Legal position

Good-faith reports are welcome. A formal safe-harbor statement, describing how PastePile Labs LLC will treat research that follows this policy, is under legal review and is not offered yet.

Last updated 2026-10-15.