Security & coordinated disclosure

1. How we protect our services

• Threat-modeled by default. Every new surface — an endpoint, a webhook, a form — is threat-modeled before it ships. Security review is part of done, not a follow-up.
• Least privilege. Production access is limited to what each person and service needs. Credentials live in platform secret stores, never in source code or configuration files.
• Edge-first. Our sites are served and protected by a global edge network, with strict transport security, a restrictive content security policy and no open origin.
• Server-side integrity. Results that matter are computed and verified on our servers, never trusted to a client.
• Minimal data. We collect only what a feature needs, so there is less to protect and less to lose.

2. Reporting a vulnerability

Email security@syrosin.com with the subject “Security report”. Please include:

• the affected URL, service or component;
• a description of the issue and its potential impact;
• clear steps to reproduce it, with a proof of concept if you have one; and
• how you would like to be credited, if at all.

If a report contains sensitive details, tell us in a first message and we will arrange a suitable way to share them.

3. Scope

In scope: syrosin.com and typemuse.com, including the TYPEMUSE pre-registration service.

Out of scope:

• denial-of-service, load or volumetric testing;
• social engineering, phishing or physical attacks;
• third-party services we use, such as our hosting, analytics and email providers — report those to the provider;
• findings without a demonstrated security impact, such as missing best-practice headers on non-sensitive pages, clickjacking on pages with no state-changing actions, or version disclosure.

4. Safe harbor

If you act in good faith and follow this policy, we consider your research authorized, and we will not pursue or support legal action against you for it. Please:

• test only against accounts and data you own, or have explicit permission to use;
• stop and report as soon as you reach personal data, and do not keep, share or modify it;
• avoid degrading our services or anyone’s experience of them;
• give us reasonable time to fix an issue before disclosing it; and
• do not demand payment in exchange for withholding or deleting a report.

We do not run a paid bug bounty at this time.

5. What to expect

• We acknowledge your report within 3 business days.
• We confirm whether we can reproduce it and share our assessment of its severity.
• We keep you updated as we fix it, and tell you when it is resolved.
• With your permission, we credit you once the fix is live.

6. Contact

Security reports: security@syrosin.com. For anything else, see Contact. Syrosin reviews this policy at least once a year.