Markero welcomes good-faith security reports. Please give us a chance to fix an issue before disclosing it publicly.

In scope

• The production web application at chat.markero.eu and the public site at markero.eu.
• The Android application and its update channel.
• Authentication, session handling, encryption, key wrapping and file handling.
• The API and WebSocket endpoints.
• The official Tor onion service.

Out of scope

• Social engineering, phishing or physical attacks against staff or users.
• Denial-of-service, spam or volumetric attacks.
• Issues that require a compromised device, browser extension or operating system.
• Third-party services used for payments, push notifications or GIF search.
• Automated scanner output without a plausible, reproducible impact.

How to report

Email [email protected] with the subject Security report. If the report contains sensitive details, encrypt it with the Markero website OpenPGP key. The fingerprint is published on the press page and in security.txt.

Include:

• A description of the issue and the affected component.
• Steps to reproduce it, including the account state and browser or device.
• The impact you believe it has.
• A proof of concept, screenshots or logs where useful.

Use your own test accounts. Do not access, modify, retain or disclose another person's data. If you encounter user data during testing, stop and report it without copying it.

What to expect

• We will acknowledge receipt and ask for clarification if needed.
• We will triage the report and tell you whether it is in scope.
• We will fix confirmed issues as quickly as severity allows and keep you informed of progress.
• We will credit you in the fix note if you want credit. Tell us how you want to be named.

Coordinated disclosure

Please do not publish details before a fix is available. We will coordinate a disclosure date with you and explain any delay. If a report affects other users, we may need to notify them or rotate credentials before public disclosure.

Paid bounty

Markero does not currently operate a paid bug bounty program. We still review every report and credit researchers who follow this policy.

Acknowledgments

We thank the researchers who report issues responsibly. Names are published only with permission.