Responsible disclosure

This policy covers:

• app.letterpier.com, the web app and the API;
• mail.letterpier.com, our SMTP service.

Please don’t test or report:

• denial of service and load tests;
• spam or bulk sending;
• social engineering of our operator, our providers or our customers;
• physical attacks;
• the services of third-party providers (OVH, Neon, Vercel), which you should report to them directly;
• our customers’ domains and endpoints.

When you test, please:

1. use only your own test accounts;
2. don’t access, change or keep other people’s data beyond a minimal proof of concept;
3. don’t send mail to real third parties;
4. stop and report as soon as you have access to data that isn’t yours;
5. give us 90 days from your report before you publish anything about it, unless we agree on a different date with you.

Email mail@michael-ketzer.com. Please include:

• what you found and where;
• the steps to reproduce it;
• the impact you expect;
• how we can reach you.

You can write in English or German. Our machine-readable contact details are published at /.well-known/security.txt (RFC 9116). We don’t publish an encryption key yet, so please don’t send secrets or other people’s personal data in your first message.

These are goals, not guarantees. We aim to:

• acknowledge your report within 5 business days;
• keep you updated while we investigate and fix the issue;
• credit you, if you wish.

There is no bug bounty at this time.

If you act in good faith and within this policy, we will not take civil action against you or file a criminal complaint (Strafantrag).

Public prosecutors can act on their own in some cases, so this is not a promise of immunity. [For legal review: §§ 202a and 202b StGB are prosecuted on complaint unless prosecutors see a special public interest (§ 205 StGB); confirm the wording of this clause.]