Report a security problem.

Report a vulnerability

Use the form on this page. It goes straight to us, and only to us. Please don’t post details publicly, open a public issue, or tell anyone else until we’ve fixed it, or we’ve agreed a date together.

What to include

• What’s affected: the app and its version, the extension version, or the page on hard.fyi.
• Steps to reproduce it, and what someone could do with it.
• Your macOS, iOS or browser version, if it matters.
• Whether you’d like to be thanked by name.

Please keep any proof of concept to the minimum needed to show the problem, and don’t include anyone else’s data.

What’s in scope

In scope

• HARD for Mac, including its network filter, the hard command, the MCP server and the bridge to the browser extension.
• HARD for iPhone, including the scam-text filter and HARD codes.
• The HARD browser extension for Chrome and Brave.
• hard.fyi, including its forms and /api/.
• Ways around HARD’s protections: a lookalike or copied sign-in page it should catch, a way to make a payment skip the pause, or a way to make the firewall miss a connection.

Out of scope

• Denial of service, flooding our forms, or anything that slows the site for others.
• Social engineering of our staff or members, and physical attacks.
• Other companies’ services that HARD uses, such as Cloudflare, Anthropic or Apple. Report those to them.
• Reports from automated scanners, or missing headers and settings, without a way to use them.
• Problems that need a device that’s already compromised or unlocked in someone else’s hands.

What we commit to

• We’ll confirm we’ve received your report.
• We’ll look into it, tell you what we found, and keep you updated while we fix it.
• We’ll tell you when it’s fixed, and agree with you when it can be made public.
• If you’d like, we’ll thank you by name here once it’s fixed.
• We’ll fix problems that put people at risk first.

We don’t offer payment for reports at the moment.

Good-faith research

If you research in good faith and follow this page, we won’t take legal action against you or ask anyone else to. Good faith means you:

• only test against your own accounts, devices and data;
• stop as soon as you reach anyone else’s data, don’t keep it, and tell us;
• don’t disrupt HARD for anyone else;
• give us reasonable time to fix the problem before telling anyone.

If you’re unsure whether something is allowed, ask us first through the form below.

Send a report

It goes only to us. We reply to the email address you give.