Legal
Security
Found something? Tell us. Here is how to report a vulnerability and what this site does to keep you safe.
Report a vulnerability
Email 4d@emersa.io. A human reads it. Tell us what you found, where, how to reproduce it and what you think it could do. We will reply, keep you posted while we fix it, and credit you if you would like that.
Our machine-readable contact is published at /.well-known/security.txt, following RFC 9116.
While you test, please:
- Do not read, change or delete data that is not yours, and stop as soon as you can show the issue.
- Do not degrade the service for other people: no flooding, no denial of service.
- Do not use social engineering, phishing or physical attacks against our people or our partners.
- Give us a reasonable time to fix the issue before you publish anything about it.
Research done in good faith within these rules is welcome, and we will not pursue it.
What this site does
- A strict Content Security Policy: no inline scripts, no inline styles, no scripts from any other origin, no frames.
- No third-party scripts. Fonts, styles and code are all served from emersa.io.
- No keys in the browser. Every secret stays on the server; the page never carries an API key.
- HTTPS everywhere with HSTS, and headers that stop the site being framed or its content type being guessed.
- The contact form goes through a same-site check, a size cap and rate limits, and we never store your IP address.
- No cookies and no analytics today. The voice features planned for later will ask for your consent first; see the privacy policy.
- Dependencies are pinned to exact versions and reviewed before they change.
Scope
This page covers emersa.io and its API. Krupiq has its own site; Cloudflare, Postmark and LinkedIn run their own programmes. If you are not sure where a finding belongs, write to us anyway and we will point you to the right place.