Security

How to report

Email support@mirrormail.app with “Security” in the subject. Please include:

• what you found and where (the page, API path or plugin step);
• steps to reproduce it, with any requests, screenshots or a proof of concept;
• what an attacker could do with it.

What happens next

• We acknowledge your report within 3 business days.
• We confirm the issue, tell you what we're doing about it, and keep you updated until it's fixed.
• Confirmed vulnerabilities are fixed as a priority, ahead of other work.
• Once it's fixed, we're glad to credit you by name if you'd like.

We don't run a paid bug bounty.

In scope

• mirrormail.app, its pages and its API;
• the Mirror Mail Figma plugin.

Issues in Figma, Klaviyo, Stripe, Google, Fly.io or Cloudflare belong to them: please report those to the company concerned.

Please don't

• access, change or delete data that isn't yours: test with your own account and Klaviyo account;
• run denial-of-service or load tests, or anything else that degrades the service for others;
• use social engineering, phishing or physical attacks;
• share the issue publicly until it's fixed or 90 days have passed since your report, whichever comes first.

Good-faith research

If you follow this page, we consider your research authorized and won't take legal action against you for it. If you're unsure whether something is allowed, ask us first at support@mirrormail.app.

How we protect your data

• Every connection is HTTPS, with HSTS.
• Passwords are stored as bcrypt hashes, never as text.
• Klaviyo API keys and OAuth tokens are encrypted on our servers (AES-256-GCM) and never sent to the plugin.
• The Figma plugin keeps only a Mirror Mail sign-in token, and reads only the frame you choose to export.
• Dependencies are checked for known vulnerabilities on every build and updated weekly.

What we store and for how long is in our Privacy Policy.