Security policy

How we protect your files

What we do with what you entrust to us:

• Without custody, we do not keep your files: we store only their fingerprint (SHA-256). With Sellat Local, the file never even leaves your device.
• If you turn custody on, we encrypt the file at Sellat before sending it to storage, with a different key for every file (AES-256-GCM). The storage provider, in the European Union, only holds encrypted data and cannot open it.
• The key that opens them is on our servers, kept apart from the storage.
• Every time you download an original we check that its fingerprint matches your proof. If it does not, we do not hand it over.

How to report

Write to security@sellat.app. You can do so in Catalan, Spanish or English.

So that we can reproduce and assess it, include:

• A description of the vulnerability.
• The steps to reproduce it.
• The impact you believe it has.
• The affected URL or endpoint.

Our commitment

When we receive your report:

• We will acknowledge it within 72 hours.
• We will update you on its status at least every 7 days until it is closed.
• We will fix it within a reasonable time, according to its severity.
• If you wish, we will credit you publicly in the acknowledgments section.

Safe harbour

We will not take any legal action against anyone who researches in good faith and respects this policy.

If you are unsure whether a test is allowed, ask us first at security@sellat.app.

Rules

While you research:

• Do not access, modify or destroy other people’s data. If you come across it by accident, stop and let us know.
• No denial of service (DoS), spam, social engineering or physical attacks.
• Use only accounts that are your own.
• Give us a reasonable time to fix the problem before you make it public.

Out of scope

We do not treat these as vulnerabilities unless you show real impact:

• Reports from automated scanners without proof of impact.
• Missing security headers with no possible exploit.
• Clickjacking on pages without sensitive actions.
• SPF or DMARC configuration.
• Self-XSS.
• Rate limits on non-critical endpoints.

Rewards

We do not have a paid bug bounty programme at the moment. What we can offer is our public thanks, if you want it.

Acknowledgments

People who have reported a vulnerability to us responsibly and agreed to be listed here.