Security
Found a problem? Tell us.
If you think you've found a security problem in Five Rooms (the apps, fiverooms.app, or the web version at create.fiverooms.app and read.fiverooms.app), we'd like to hear about it, and we'll work with you to fix it.
How to report
Email security@fiverooms.app with what you found, how to reproduce it, and what you think someone could do with it. Please don't put the details anywhere public until it's fixed.
We'll reply within five working days, tell you what we're doing about it, and let you know when it's fixed. If you'd like to be thanked by name when we mention the fix, say so.
Testing in good faith
Test only with accounts and projects that are your own. Don't read, change or delete anyone else's writing or account, don't try to stop the service working for others, and stop and tell us as soon as you reach anything that isn't yours. If you keep to that, we won't take action against you for your research.
Five Rooms is made by one person, so there's no bug bounty.
How your writing is protected
- Projects on the web are encrypted on your own devices before they're sent; our servers store only locked copies and never see your text or your keys. The privacy notice says what the servers can see.
- There are no passwords. You sign in with a passkey, and changes such as adding a device, removing a passkey or taking a project off the web ask for your passkey again.
- Every page of the web version runs under a strict content security policy, and every connection uses HTTPS.
Machine-readable contact details are at /.well-known/security.txt.