Security

Report a security problem privately

To report a security problem, email feedback@bubblewith.com.

Tell us what you saw, the smallest steps that reproduce it, and which browser or device you used. Please don’t send an invite link, recovery phrase, private key, exported bubble or anyone else’s data. If we need evidence, we’ll arrange a safe way to share it.

What happens next

• We’ll reply within three working days.
• We’ll give a first assessment, or ask for what’s missing, within seven calendar days.
• After that, we’ll update you at least every seven calendar days until it’s fixed or closed.

If a report shows an immediate risk, we may pause the affected feature while we look into it.

Good-faith research

If you investigate and report in good faith, stay within your own devices and test data, avoid disrupting the service, and give us a reasonable chance to fix the problem, we will not threaten or pursue you merely for finding and reporting it.

Please stop if a test could expose another person’s content, identity or device. Don’t keep or share any data you come across. Don’t use denial-of-service, social engineering, physical attacks or high-volume automated scanning, and don’t ask for money in exchange for not reporting. This doesn’t authorise anything unlawful or bind anyone else.