Report it, and we will fix it.

What an attack looks like here

There is no backend, no database and no account system, so the usual targets do not exist — there is no server-side store to breach and no credentials of ours to steal. What that leaves is the code that runs in your browser, which is where any real vulnerability in this product will be.

• The note renderer is the sharpest edge. A shared note arrives as text from someone else's link, so it is sanitised against an explicit allowlist before it is displayed. A way past that allowlist is the highest-value bug on the site, and it already has an adversarial test suite aimed at it.
• Anything that causes a tool to transmit what it was given would contradict the product's central claim, and we would treat it as critical.
• Anything that persists across origins, or that lets one page read another's stored codes, notes or saved pages.
• Supply chain: the site is static and its dependencies are pinned, but a compromised package would reach the browser like any other code.

Reporting

Email contact@cloudexistechnologies.com with enough detail to reproduce it. There is no bug bounty — this is a free tool with no revenue — so we cannot offer payment, and we would rather say that plainly than leave it implied.

We will confirm we received it, tell you what we found, and credit you when it is fixed if you would like to be credited.

What we ask

Test against your own browser and your own files. Do not attempt anything that would affect other people, and do not use a finding to access data that is not yours — though in practice there is very little here to reach, since nothing you do leaves your device.