EveryPage stores documents encrypted at rest and never stores reader IP addresses. If you have found a way to break either promise - or any other vulnerability in everypage.co or the code published by this account - we want to hear about it.

• Email support@everypage.co with SECURITY in the subject line.
• Include what you found, where, and how to reproduce it. A proof of concept helps; mass exploitation does not - please stop at demonstration.
• You will get an acknowledgement within 2 business days, and a status update once the report is triaged.

• Open a public GitHub issue for a vulnerability - issues are public the moment they are filed.
• Access, modify, or retain other people's documents or data while testing.
• Run automated scanners against everypage.co at volume - rate limits will throttle you long before anything interesting happens.

• In scope: everypage.co, the EveryPage API (/api/v1), webhooks, and the code published by this account.
• Out of scope: social engineering, physical attacks, and denial of service.
• There is no bug bounty programme - EveryPage is an independent, self-funded product. Reports are still genuinely appreciated, credited if you want credit, and fixed with priority.

EveryPage - operated from the United Kingdom.