Responsible disclosure

How to report

Email hello@mumbrane.com with “Security” in the subject. Please include the URL, the steps to reproduce, the impact, and whether you have shared the finding with anyone else. Do not include personal data you obtained.

What we ask

• Give us a reasonable time to fix the issue before disclosing it.
• Do not access, modify, or delete data that isn’t yours.
• No denial-of-service, spam, social engineering, or physical tests.
• Stop and report as soon as you have shown the issue.

What we do

We acknowledge your report and keep you informed until it is resolved. If you wish, we credit you for the finding.

Scope

In scope: mumbrane.com.

Out of scope: third-party services linked from the site, findings that require a compromised device, missing headers without a demonstrated impact, and automated scanner output without a proof of concept.

Safe harbor

If you make a good-faith effort to follow this policy, we will treat your research as authorized and will not take legal action against you for it.