Reporting a security problem

What this covers

• The Cairn desktop app.
• The licence service that activates and checks licences.
• This website, including signing in and your account.

Estate information never reaches us — it stays on the computer where it was entered. So a problem in the licence service or this website involves account data: email addresses, the sign-in service each account uses and the account identifier it gives us, licence and computer records, sign-in sessions and server logs. The privacy policy lists all of it.

How to report it

Email [email protected] and include:

• what is affected — the version of Cairn, or the web address;
• the steps that show the problem;
• what someone could do with it;
• how to reach you, if not at the address you write from.

We aim to acknowledge every report within 5 business days.

While you look

• Please don't access, change or delete anyone else's data.
• Use your own account and licence for testing.
• Please don't run anything that slows down or interrupts the service for others.

No bug bounty

We don't run a bug bounty and can't pay for reports. Every report is read, and we are grateful for each one.