Reporting a vulnerability
Report security issues tosecurity@iscreambyte.com. Your report will be acknowledged, and you'll be kept informed as it is investigated and fixed.
- There is no bounty program at this time.
- Please avoid accessing other users' data while researching — a proof of concept against your own account or a local install is always enough.
This policy is also published at/.well-known/security.txt.
Cascadia security model
- OAuth2 sign-in with PKCE — Cascadia never sees your password.
- HttpOnly session cookies.
- CSRF protection on state-changing requests.
- TLS everywhere.
Aksimuth security model
- Local-first: no account, no backend, no telemetry.
- Credentials never leave your machine.
- Mutations go through dry-run previews with explicit confirmation.
The full model is documented on theAksimuth security section.