Report a security problem

Where to send it

Write to security@cashel.io. Your own mail program sends it to us. This website holds no form and receives nothing itself.

Scanners and researchers who look for the file atcashel.io/.well-known/security.txt find the same address there.

What to put in it

Tell us what you found and how to see it happen: the steps you took, and what happened that should not have. A screenshot or a short recording helps. Write in English.

Please leave other people’s data out of the report. We do not need it to understand what you found.

What happens next

We are not going to promise a number of days, because it is a promise we could not keep yet. Once we have looked at what you sent, we will tell you whether it is real and what we are doing about it, and we will tell you again when it is fixed.

There is no reward and no bug bounty.

Looking for problems is welcome

We will not take legal action against anyone who reports a problem in good faith. Good faith means you did no damage, you did not read, take or change data belonging to anyone else, and you came to us first, so we had the chance to fix it before anyone else knew.