NaazhiSecurity
Found a bug? Tell us first.
Your notes and journal are personal, so we take security reports seriously. Here is how to report a problem safely and what you can expect from us.
Scope
What to test, and what not to.
In scope
- The Naazhi website and web app
- The Naazhi Android app
- Our sign-in, sharing and billing flows
- Anything that exposes another person’s notes, journal, chats or files
Out of scope
- Denial-of-service or load testing
- Spam, phishing or social engineering of our team or users
- Physical attacks, or attacks on our hosting providers or other companies’ services
- Reports from automated scanners with no demonstrated impact
Ground rules
Test with care.
Good-faith research that follows these rules is welcome. We will not take action against you for it.
- 01Use only your own account and data. Don’t read, change or keep anyone else’s data.
- 02Stop as soon as you have shown the problem, and don’t go further than you must.
- 03Give us reasonable time to fix it before you share details with anyone else.
- 04Don’t degrade the service for other people.
What happens next
From report to fix.
01
Send a report
Email us the details, from an address we can reply to.
- What you found and where
- Steps to reproduce it
- What you think the impact is
02
We confirm
We read every report and reply to say we have it.
- Within 3 working days
- We may ask a question
03
We fix
We work on a fix and keep you posted on how it is going.
- We tell you when it is fixed
- We keep your details private
04
We thank you
With your permission, we credit you for the find.
- Credit is optional and your choice
This page is also published in machine-readable form at /.well-known/security.txt. Last updated 13 November 2026. We don’t run a paid bounty programme.
See something worrying?
Write to us now. A short report is better than none.