Security
We keep the website small, serve it over HTTPS and keep secrets out of the browser. If you find a security issue, email info@moozz.com with enough detail to reproduce it. Please do not test against other users, the product or third-party services.
Last updated 2026-10-21
Report a vulnerability
Email info@moozz.com with “Security” in the subject line. Include the URL, the steps to reproduce, the impact and any evidence. We will acknowledge the report and tell you what we can share about the fix.
Our security contact and disclosure policy are also published at /.well-known/security.txt.
What we do
- Serve the site over HTTPS with HSTS in production.
- Keep secrets in server-side environment variables, never in the browser bundle.
- Use a small dependency surface and review it when it changes.
- Set a content security policy, frame-ancestors, nosniff and a referrer policy at the host.
- Keep analytics behind consent and do not load third-party scripts before a choice.
- Use least-privilege access for the deployment and CRM systems.
Scope
This page covers the marketing website. The product, auth service, CRM and Liner have their own security contacts and scope. Do not attempt to access another person’s account, upload malware, run denial-of-service tests or social-engineer the team.
No guarantee
No website can promise perfect security. We investigate credible reports and fix what we can. We do not offer a bug bounty unless we have agreed one in writing.
Questions and answers
Do you have a bug bounty?
Not at the moment. We still welcome responsible reports and will credit a reporter if they want and if it is appropriate.
Where is the security contact?
Email info@moozz.com with “Security” in the subject, or use the contact in /.well-known/security.txt.