Typist is built and run by one person. There is no security team and no bug bounty. If you find a real problem, tell us and we will fix it.
How to report
Email security@iamtypist.dev with the affected URL, the steps to reproduce, and what an attacker could do with it. Please give us time to fix the issue before you make it public.
We read every report and we reply. We cannot promise a response time, because this is one person and not a rota.
Scope
In scope: iamtypist.dev, its subdomains, and the Typist MCP server.
Out of scope, and we will close these without a long reply:
- Scanner output with no working exploit
- Theoretical issues with no proof of impact
- Missing HTTP headers such as CSP, and permissive CORS
- Best-practice notes on SPF, DKIM, or DMARC records
- Rate limits on public pages
- Anything that needs a rooted device or a browser we do not support
Rules for testing
Test only against accounts and files you own. Do not:
- Read, change, or delete another user's account, files, or transcripts
- Run denial of service, load, or brute force tests
- Send phishing or social engineering to our users or our providers
- Attack our providers directly (Cloudflare, Stripe, ElevenLabs, Groq)
- Keep user data you reach by accident, report it and delete it
Our side
Research that follows the rules above is authorized. We will not pursue legal action over it.
There is no cash reward. We credit you on this page when the fix ships if you want that, and we are happy to hand out free Typist credits as thanks.
Machine-readable policy
This page is also published as /.well-known/security.txt under RFC 9116.