Report a vulnerability

Email support@usemuzzle.com with "Security" in the subject.

Last updated 29 October 2026

• Security
• Sub-processors
• DPA
• Report a vulnerability

What to send

• What is affected: app version, URL or endpoint
• Steps to reproduce, or a proof of concept
• What an attacker could do with it

What happens next

1. We confirm we have your report within 3 working days.
2. We tell you whether we can reproduce it and what we plan to do.
3. When the fix ships, we tell you, and credit you if you want.

We don't pay bounties.

In scope

• The Muzzle app for macOS, latest version, including its hooks, command-line tool and local proxy
• usemuzzle.com and api.usemuzzle.com
• Contact-address mail handling on in.usemuzzle.com
• Signature checks on updates, licences and Threat Feed rules

Ways to get a secret past Muzzle's checks are welcome too. We treat them as detection improvements unless they switch Muzzle off or defeat a signature check.

Out of scope

• Services we use, such as Stripe checkout, Cloudflare and Resend: report to them
• Denial of service, load testing, spam and social engineering
• Attacks that need an already compromised Mac or administrator access to it
• Missing headers or best practices without a demonstrated impact

Rules

• Test only with your own Macs, keys, accounts and contact addresses.
• Don't access, change or keep other people's data. If you come across any, stop and tell us.
• Give us 90 days to fix the issue before you publish, or less if we agree.

Safe harbour

If you follow this policy in good faith, we consider your research authorised, won't take legal action against you or report you to law enforcement, and will say so if someone else does. This covers only aabergkvist AB, not third parties.