Reporting a security problem
How to report a security problem in Mimir, Cloud Sync, or a published page, what's in scope, and what happens after you send it.
Effective 2026-10-30.
If you find a security problem in Mimir, email security@justmimir.com. Mimir is built and run by one person, Geffrey van der Bos, so your report comes straight to me. Please don’t open a public issue or post about it until it’s fixed.
What’s in scope
- The Mimir app on Mac, iPhone, and iPad, including its updates.
- Cloud Sync, and the server at
sync.justmimir.com. - Published pages at
mimr.page. - Every site under
justmimir.com.
Polar handles checkout and Cloudflare serves the websites. A problem in either of those belongs with them.
What to send
Say what you found, how to reproduce it, and what someone could do with it. Include the app version if the problem is in the app. A proof of concept helps but isn’t required.
If an AI tool found the problem, reproduce it yourself before you send it, and say which tool you used. A report that doesn’t reproduce costs us both time.
How to test
- Use your own notes, your own published pages, and your own Cloud Sync account. If you need Cloud Sync to test something, ask, and I’ll send you a license key.
- Never read, change, or delete someone else’s notes or pages. If you reach someone else’s data by accident, stop, don’t keep a copy, and say so in your report.
- Don’t flood the sync server or the sites, and don’t try to take them down.
- Don’t send spam, try to trick people, or contact other Mimir users.
What happens next
I reply within a week to say I got your report, and I keep you posted until it’s fixed. Please wait until the fix is out, or 90 days, whichever comes first, before you publish anything. If you’d like credit, I’ll name you in the changelog entry for the fix.
Mimir has no bug bounty, so there’s no payment for a report.
If you follow this page in good faith, I treat your research as authorized, and I won’t take legal action against you over it.