Security

Reporting a vulnerability

Email security@withbella.io. Please include:

• a description of the issue and its impact,
• steps to reproduce (a proof of concept if you have one),
• the Bella Mail version and operating system you tested on.

Please do not open a public issue for a suspected vulnerability.

Scope

In scope: the Bella Mail desktop application and its official update and download channels.

Out of scope: social engineering or phishing of our people, physical attacks, denial-of-service or volumetric testing, automated scanner output with no demonstrated impact, and issues in third-party services we do not control.

Safe harbour

If you act in good faith and follow this policy, we will not pursue legal action against you. Good faith means you:

• make a reasonable effort to avoid privacy violations, data destruction and service disruption,
• only access your own accounts and data, and stop and tell us if you encounter anyone else's,
• give us a reasonable time to fix the issue before you disclose it publicly.

What to expect

• We will acknowledge your report within 3 business days.
• We will give you an initial assessment within 10 business days.
• We will keep you updated until the issue is resolved and, with your agreement, credit you when it is disclosed.

Supported versions

We fix security issues in the latest released version of Bella Mail.