Security

Last updated: 23 October 2026

If you think you've found a security problem in dontlosedata, please tell us. Email [email protected] with what you found, how to reproduce it and what someone could do with it. A person reads every report and replies within three working days.

What's in scope

• The website and dashboard at dontlosedata.site.
• The API: endpoints, API keys, form submissions and the request log.
• Signing in with Google and anything that lets one account reach another account's data.

Please don't

• Read, change or delete data that isn't yours. Test with endpoints you created yourself.
• Flood the service, run load tests or anything else that slows it down for other people.
• Send spam, phish our users or try to trick anyone who works on dontlosedata.
• Share the problem publicly before we've fixed it.

Not a security problem

• Anyone with an endpoint's address can read and change it unless it's protected with an API key. That's how it's designed.
• Endpoints accept requests from any website (CORS). That's on purpose, so apps in the browser can use them.
• Reports from automated scanners with no working example of the problem.

What we promise

• If you follow this page in good faith, we won't take legal action against you or ask anyone else to.
• We'll keep you updated while we fix it and tell you when it's done.
• With your permission, we'll thank you by name once it's fixed.

dontlosedata is in beta and doesn't pay bug bounties yet.

The same contact details are in machine-readable form at /.well-known/security.txt.