Legal

Vulnerability disclosure policy

Effective 18 October 2026.

If you find a security issue in Recordist, we want to hear about it, and we will work on it with you. Email security@recordist.app. This page says what to send, what we cover, how fast we answer, and the promise we make to people who research in good faith.

How to report

Write to security@recordist.app with:

what you found and where (the app, the extension, the gateway, the website or the licence service), with the version and platform;
the steps to reproduce it, and a proof of concept if you have one;
what an attacker could do with it, as you understand it;
whether you would like to be credited, and the name to use.

Please do not open a public issue or post about it first. Send no recording, transcript or personal data belonging to anyone else; screenshots and your own test data are enough. We do not publish an encryption key yet. If your report needs one, say so in a first short email and we will agree a way to receive it.

What happens next

A person acknowledges your report within 3 business days.
We tell you whether we can reproduce it and keep you informed as we work on it.
We aim to ship a fix for confirmed high-severity issues within 14 days.
We tell you when the fix is released, and credit you in the changelog if you wish.

There is no paid bounty programme at this time.

In scope

The Recordist desktop app for Mac, Windows and Linux, including its local API on 127.0.0.1 and its update and licence checks.
The Recordist browser extension.
The MCP gateway, @recordist/gateway on npm.
recordist.app and its functions under /api/, the download routes under /get/, the licence service at license.recordist.app, and the integrity of the files and update feed served from media.recordist.app.

Out of scope

Services we do not run, even where Recordist works with them: AI providers a person connects, Ollama itself, meeting platforms, Stripe's checkout pages and our hosting provider's own infrastructure. Report those to their owners.
Social engineering, phishing or physical attacks against anyone, including our team.
Denial of service, load testing, and automated submissions to the site's forms.
Findings with no demonstrated security impact, such as scanner output alone, or a missing header on a static page that carries no data.
Attacks that need someone else's unlocked computer or their operating-system account. Recordist's files are protected by that account, as the security page explains.

Good faith

To stay within this policy:

Test only against your own installation, your own data and your own accounts.
Do not access, change or delete data that is not yours. If you reach any by accident, stop, tell us, and keep no copy.
Do not degrade the website, the licence service or the download host for anyone else.
Give us time to fix the issue before you publish: until a fix is released, or 90 days after your report, whichever comes first. If we need longer, we will explain why and agree a date with you. Once a fix is out, you are welcome to publish.

Safe harbour

If you research and report in good faith under this policy, we consider your research authorised. We will not bring or support legal action against you for it. For research under this policy, we waive the parts of our Terms that would otherwise forbid it, such as the ban on reverse-engineering the licence mechanism and the update checks, to the extent the research needs, though never to use Pro without a licence or to share a way around the licence check. If someone else brings an action against you over research that followed this policy, we will make it known that we authorised it.

We can only authorise research on what is ours. If you are unsure whether something is in scope or allowed, ask us at security@recordist.app before you test it.

Supported versions

Security fixes are released for the current minor version. The Free plan receives them on the same day as paid plans.

How users are told

A security notice in the update feed shows a banner in the app for the versions it names, while update checks are on. People who asked on the download page for news of new versions, and confirmed, also receive an email for a security notice. Every fix is listed in the changelog.

Machine-readable contact

This policy and the address above are published in /.well-known/security.txt, as RFC 9116 describes. The security page describes how Recordist is built, and the Trust Center has the plain-language version.