Vulnerability Disclosure Policy

Last updated: 2026-06-04

We want Boswell to be safe to use. If you've found a security vulnerability in Boswell, we'd genuinely like to hear about it. This policy explains what's in scope, how to report a problem, and what you can expect from us in return.

Reporting a vulnerability

Email security@meetboswell.com with:

• a clear description of the issue and where you found it,
• the steps needed to reproduce it (a proof of concept helps a lot),
• the potential impact as you see it, and
• any suggested fix, if you have one.

Please report in English where you can. If you need to share sensitive details, say so and we'll arrange a secure channel.

What to expect: we aim to acknowledge your report within 5 business days, keep you updated as we investigate, and let you know when the issue is resolved. We'll credit you for the discovery if you'd like to be named and the report leads to a fix — just tell us how you'd like to be acknowledged.

Good-faith guidelines

We consider security research conducted under this policy to be authorized, provided you:

• Stay in scope. Only test the systems listed under "In scope" below.
• Avoid harm to people's privacy and data. Don't access, modify, download, or delete data that isn't yours. If you come across someone else's personal data while testing, stop, don't save it, and tell us in your report.
• Don't degrade the service. No denial-of-service, no spam, no automated scanning that floods our systems or third-party providers, and no social engineering of our team, our users, or our vendors.
• Use your own accounts and test data. Don't pivot into other people's accounts.
• Give us time to fix it. Hold the details of any vulnerability confidential until we've had a reasonable chance to remediate — please allow up to 90 days from your report before any public disclosure, and coordinate timing with us.
• Don't break the law. Nothing in this policy authorizes activity that violates applicable law.

Safe harbor

If you make a good-faith effort to follow this policy while researching and reporting a vulnerability, we will not pursue or support legal action against you for that research, and we'll treat your activity as authorized under the laws that govern unauthorized access to computer systems. If a third party brings a claim against you for activity that was conducted in line with this policy, we'll make it known that your actions were authorized.

This safe harbor covers only the systems we operate and control (see "In scope"). It cannot waive the rights of third parties, and it does not authorize you to break laws or to act against systems we don't own. If you're ever unsure whether something is permitted, ask us first at security@meetboswell.com — we're happy to clarify before you test.

In scope

• The Boswell website, https://meetboswell.com, and the pages and assets it serves.
• The site's API endpoints — the /api/* functions the website's forms call (for example /api/send-download-link, /api/join-waitlist). Subscription checkout, billing-portal access, and account sign-in are all initiated inside the macOS app, sign-in-gated, not from the website.
• The Boswell macOS app itself — including how it handles local data, permissions, sign-in, and entitlement checks.

Out of scope

The following are operated by third parties, not by Boswell, and are not covered by this policy. Please report issues in them directly to the vendor, not to us:

• Stripe — payment processing and the hosted Checkout / Customer Portal.
• The Supabase platform itself (as opposed to our own functions running on it).
• Resend — transactional email delivery.
• PostHog — the optional, opt-in analytics service.
• Netlify — our website host and CDN.

Also out of scope, and not something we'll usually act on: reports that are purely theoretical with no demonstrated impact, missing security headers without a concrete exploit, best-practice or "hardening" suggestions with no vulnerability behind them, and findings that require physical access to a victim's unlocked Mac, social engineering, or a compromised device.

A note on Boswell's design

Boswell is local-first: your recordings and transcripts stay on your Mac and are never uploaded to a Boswell server. The only data we hold server-side is the record that supports your subscription (see our Privacy Policy). That shapes what's interesting from a security standpoint — the highest-value targets are the sign-in and entitlement flow, the subscription backend, and anything that could cause the app to leak local data off the device.

Contact

Security reports: security@meetboswell.com. For non-security questions, use support@meetboswell.com instead.