Reporting a security problem

Last updated: 25 October 2026

If you find a security problem in Snipkin, Tweakle, Shakelf or Quotch, or on this website, please tell me privately first, so it can be fixed before anyone can misuse it. This page explains how to report it, what you can expect from me, and the few things that are not allowed while you look.

How to report

Write to [email protected] (hi (at) ontagonal.app) with “Security” in the subject, or use the contact form. English and Romanian are both fine. Please include:

• which app and which version, or which page of the site;
• what the problem is, and what someone could do with it;
• the steps to reproduce it, with your macOS version if it is about an app.

The same contact details are in security.txt.

What you can expect

• A reply. I will reply to confirm that I have your report and to tell you whether I can reproduce the problem. As with support, I do not promise a response time.
• News of the fix. I will tell you what I decide to do and when the fix is out. I am one person, so I do not promise a date for the fix itself.
• Credit, if you want it. Tell me whether you would like to be named when the fix is published, and how, or whether you would rather stay anonymous.
• No bounty. These are small apps made by one person, and there is no paid bug bounty.

Please keep the details private until the fix is out, or until we agree on when to publish them.

What is not allowed

Look for problems on your own copy of an app and with your own accounts. While you do:

• No attacks on availability. No denial of service, no load or stress testing, and no flooding of the site or of my mailbox.
• No access to other people's data. Do not open, copy, change or delete data that is not yours. If you come across some by accident, stop there, do not keep it, and mention it in your report.
• No automated requests to the contact form. Every message it accepts lands in a real inbox, so no scripts, scanners or repeated submissions. To show a problem with the form, describe it, or send a single message by hand.

Security advisories

None so far. If a security problem affects one of the apps, the advisory is published here, with the versions affected and the version that fixes it.