Security

Report a vulnerability

If you found a security issue in Simplist, write to contact@simplist.blog with the subject "Security". Describe what you found, the steps to reproduce it and its impact. Please do not open a public issue before it is fixed.

We acknowledge reports within 3 working days, keep you informed while we work on a fix, and credit you when it is released if you wish.

Scope

In scope: the Simplist web app, the public API and the MCP server.

Out of scope: denial of service and load testing, social engineering, spam, physical attacks, and issues that need an already compromised device or account.

Rules for testing

Only test with accounts you own, never access or change another person's data, stop as soon as you can show the issue, and give us a reasonable time to fix it before sharing details. Reports made in good faith under these rules will not lead to legal action.

How we protect your data

Passwords and API keys are stored hashed, and API keys are shown once at creation.

Accounts can be protected with passkeys and two-factor authentication, and you can review and end your active sessions.

Public keys (pk_) can only read published posts. Writing needs a secret key (sk_) or your session, and the API is rate limited.

Traffic is served over HTTPS, and the web app and the API send standard security headers.

Open source code

The code is public, so anyone can review it. A machine readable version of this policy is available at /.well-known/security.txt.