Security: reporting a vulnerability

Email support@cliffshort.com (or use the contact form) with what you found, steps to reproduce, the impact you see and, if you like, how we should credit you. The /.well-known/security.txt file carries the same contacts in a machine-readable format.

We reply within 3 working days to confirm receipt and say what we will do. Issues exposing personal data, payments or account access come first and are fixed as fast as we can.

The cliffshort.com site and its subdomains, the APIs under /api and the video service. Always test with your own accounts and your own data.

• Do not access, change or keep other people's data: if a flaw shows you data that is not yours, stop and tell us.
• No denial-of-service, spam, phishing of our users or social engineering of the team.
• Do not publish the issue before we fix it; give us a reasonable window (up to 90 days) and we will agree the disclosure with you.

We confirm, fix, and if personal data was affected we meet our duty to notify the Portuguese data protection authority (CNPD) and the people concerned. There is no bug bounty: we thank reporters publicly if they wish, and we will not pursue anyone who follows these rules in good faith.

What you send is kept only to handle the issue and is deleted or anonymised once it is resolved.