We take the security of the Comma Compliance Messages Archiver seriously. This app handles people's private messages, so responsible disclosure matters.

If you discover a security vulnerability, please:

1. Do not open a public issue, pull request, or discussion.
2. Email us at security@commacompliance.com.
3. Include detailed, reproducible steps - what you did, what you expected, and what actually happened. A proof-of-concept or minimal repro is ideal.
4. Wait for our response before any public disclosure. We practice coordinated disclosure and will work with you on a timeline.

Please never include real message contents, recipient addresses, bearer tokens, enrollment tokens, or other private data in a report. Redact or synthesize anything sensitive; describe the class of data instead.

We reward responsibly disclosed, valid security findings. The minimum bounty is $25 for valid submissions; the actual amount scales with severity and impact. Report responsibly via the email above to be eligible.

Only the latest released version receives security updates. Please reproduce and report against the most recent release before filing.