Cogeto's product promise is verifiable trust: deletion receipts, integrity sweeps, and protections documented in the open. That only means something if security reports are taken seriously. They are.

Do not open a public issue. Report privately, either way:

• Email: hi@cogeto.eu with the subject line starting SECURITY:
• GitHub: private vulnerability reporting on this repository

Include what you can: affected component/version, reproduction steps or a proof of concept, and impact as you understand it. Reports in English or Croatian are both fine.

• Acknowledgement within 3 business days, from a human.
• We triage, keep you informed of progress, and aim to ship a fix for confirmed vulnerabilities within 90 days (faster for anything actively dangerous). Coordinated disclosure: we ask you to hold public details until a fix is released; we'll credit you in the release notes unless you prefer otherwise. There is currently no bug bounty, and we would rather say so plainly than imply one. Reports are genuinely valued and acted on.

In scope

• This repository: the application (app, worker, SPA), the compose stacks, the operator script, and the published release images (cogeto/cogeto, cogeto/cogeto-edge, cogeto/cogeto-mail).
• The public demo sandbox is explicitly in scope: it holds only fictional data and exists to be poked at. Please keep it usable for others (no volumetric/DoS testing).

Out of scope

• Customer instances are out of scope without the instance owner's written authorization. They are single-tenant deployments holding real personal data; testing them without authorization is an attack, not research.
• Volumetric denial-of-service, spam floods against inbound mail, and findings that require a compromised host or stolen credentials as a precondition.
• The marketing website (report it via the same address, but it is a separate, static codebase).

Cogeto asks users to trust it with their working memory, so the mechanisms are documented rather than asserted. docs/security/ describes each protection, the guarantee it makes, its residual limits stated plainly, and the co-located tests that enforce it on every build. That is the fastest way to see which classes of issue have already been considered and hardened, and to check the claims yourself against the code.