Security and responsible disclosure
The short version
Found a security or privacy problem? Email support@pastetense.app with a subject starting "Security:". Use made-up data only, give us a reasonable time to fix it before you share it, and we won't take legal action against good-faith research that follows this page.
How to report
Email support@pastetense.app with a subject line starting Security: followed by a few words about the issue — for example, "Security: decryptor accepts a modified key file". Please report privately first, not in a public review, forum or social media post.
What to include
- What is affected: the app, the decryptor (the copy saved from the app or the website copy) or the website, and the version if you know it.
- Your macOS version, or your browser and its version.
- Step-by-step instructions to reproduce the issue, and what an attacker could do with it.
- Any proof of concept, using made-up data only.
- Whether, and how, you would like to be credited.
Never send real secrets, real clipboard contents, real history or key files, or anyone else's data. We never need them, and email is not a safe place for them.
What to expect
- A reply from a person. Paste Tense is made by one developer; we aim to acknowledge reports within a week.
- Updates as we confirm the issue and work on a fix, and a note when it ships.
- Coordinated disclosure. Please give us a reasonable time to fix the issue before you publish — normally up to 90 days, or until a fix is released if that comes sooner. App fixes reach you through the Mac App Store after Apple's review, whose timing we don't control; we will keep you informed and agree on timing with you.
- Credit in the release notes or on this site if you would like it.
We don't run a paid bug bounty.
Scope
In scope:
- Paste Tense for Mac, the current version from the Mac App Store.
- The offline decryptor: the page saved from the app and the copy at decryptor.pastetense.app.
- This website, pastetense.app, including its response headers and
/.well-known/security.txt.
Out of scope: the systems of Apple (macOS, the App Store) and Cloudflare (the hosting platform), which have their own programmes; denial-of-service and volume testing; social engineering; physical attacks; and automated scanner output without a demonstrated problem. Limits we already describe — for example that a secret no app marked is recorded, or that encrypted files still show item counts, dates, sizes and copied files' names, sizes and folders — are not vulnerabilities on their own, but please do tell us if you find a way around a protection.
Research rules
- Test only on your own Mac, your own files and your own copy of the app or decryptor.
- Don't access, change or delete anyone else's data. If you come across real data by accident, stop, don't keep it, and tell us.
- Don't disrupt the websites for other people, and don't use automated tools at a volume that could.
- Keep the details confidential until we have agreed when to publish.
Safe harbour
If you make a good-faith effort to follow this page, we will consider your research authorised, we will not bring or support legal action against you for it, and if someone else brings action over research that followed this page, we will make it known that you acted with our authorisation. This covers only claims we control: we cannot speak for Apple, Cloudflare or any authority. If you are unsure whether something is allowed, ask us first at support@pastetense.app.
security.txt
This site publishes /.well-known/security.txt (RFC 9116), which names the same contact and links to this page.
All our policies are listed on the Legal page.