---
title: "Reporting a security problem"
description: "How to report a security problem in Mimir, Cloud Sync, or a published page, what's in scope, and what happens after you send it."
---

Effective 2026-10-30.

If you find a security problem in Mimir, email
[security@justmimir.com](mailto:security@justmimir.com). Mimir is built
and run by one person, Geffrey van der Bos, so your report comes straight
to me. Please don't open a public issue or post about it until it's fixed.

## What's in scope

- The Mimir app on Mac, iPhone, and iPad, including its updates.
- Cloud Sync, and the server at `sync.justmimir.com`.
- Published pages at `mimr.page`.
- Every site under `justmimir.com`.

Polar handles checkout and Cloudflare serves the websites. A problem in
either of those belongs with them.

## What to send

Say what you found, how to reproduce it, and what someone could do with
it. Include the app version if the problem is in the app. A proof of
concept helps but isn't required.

If an AI tool found the problem, reproduce it yourself before you send
it, and say which tool you used. A report that doesn't reproduce costs us
both time.

## How to test

- Use your own notes, your own published pages, and your own Cloud Sync
  account. If you need Cloud Sync to test something, ask, and I'll send
  you a license key.
- Never read, change, or delete someone else's notes or pages. If you
  reach someone else's data by accident, stop, don't keep a copy, and say
  so in your report.
- Don't flood the sync server or the sites, and don't try to take them
  down.
- Don't send spam, try to trick people, or contact other Mimir users.

## What happens next

I reply within a week to say I got your report, and I keep you posted
until it's fixed. Please wait until the fix is out, or 90 days, whichever
comes first, before you publish anything. If you'd like credit, I'll name
you in the changelog entry for the fix.

Mimir has no bug bounty, so there's no payment for a report.

If you follow this page in good faith, I treat your research as
authorized, and I won't take legal action against you over it.