Moodis is built and maintained by one developer. If you think you have found a security problem in Moodis, thank you. Please report it privately as described below rather than posting it publicly.

Reporting a vulnerability

Email support@moodis.app with "Security" in the subject line. Please include:

the affected component (desktop app, web app at web.moodis.app, this website, or the cloud backend), and the version or URL;
steps to reproduce;
what an attacker could do with it, and what access they would need first.

What to expect

An acknowledgement within 3 working days.
An assessment, and a fix timeline if the report is valid, within 14 days.
Public credit when the fix ships, if you want it.

Scope

In scope:

The Moodis desktop app (Windows, Linux) and its native interface.
The web app at web.moodis.app.
The cloud backend: database access rules, server functions, and image storage.
Release downloads and the update mechanism.

Out of scope:

Reports produced only by automated scanners, without a demonstrated impact on Moodis.
Missing security headers or email-authentication records (SPF, DKIM, DMARC) with no working exploit.
Denial of service, spam, and social engineering.
Third-party services Moodis uses (Supabase, Resend, Wasabi, Lemon Squeezy, Vercel). Please report those to the vendor.

Testing rules

Use only accounts and data that you own.
Do not access, modify or delete other users' data. If you reach someone else's data by accident, stop and include that in your report.
Do not degrade the service for other users.

Bug bounty

Moodis does not run a paid bug bounty program, and payment is not offered in exchange for reports or disclosure details. Valid reports are credited publicly if the reporter wants that.

Supported versions

Security fixes go into the latest release only. Please reproduce against the current version, from the download page, before reporting.

This policy is also published in machine-readable form at/.well-known/security.txt.