Security and responsible disclosure

ColdMerge sends cold email through your own Gmail or Google Workspace account. That means it holds things worth protecting: the OAuth grant to your mailbox, and the lists of people you email. If you find a way those could be exposed or misused, we want to hear about it, and this page says how.

1. How to report a problem

Email security@coldmerge.com. Please do not report security issues through public channels (a public issue, social media, or the general support address).

Tell us what you can of:

• where the problem is (the app, its API, this site, or the source repository),
• the steps to reproduce it, or a proof of concept,
• what you believe an attacker could do with it,
• how we can reach you, if you want to hear back.

The same policy is published in machine-readable form, per RFC 9116, at coldmerge.com/.well-known/security.txt and at app.coldmerge.com/.well-known/security.txt.

2. How we respond

• We acknowledge your report within 3 business days.
• We give you a first assessment (confirmed, need more detail, or not a vulnerability) within 7 days.
• Confirmed issues that could expose customer data or mailbox access are fixed as soon as possible, ahead of everything else. Other confirmed issues are scheduled against their severity, and we tell you the plan.
• We keep you informed until the issue is closed, and we credit you if you would like that.

ColdMerge is a small company. We do not currently run a paid bug bounty. We do respond to every report, and we say so here so you know what to expect.

3. What is in scope

• The product at app.coldmerge.com, including its API and the public endpoints it serves (open and click tracking, unsubscribe pages, health checks).
• The public site at coldmerge.com, including the documentation.
• The application's source code, where you have access to it.

We are especially interested in anything that crosses a boundary between customers (seeing or acting on another organization's data), anything that reaches a stored Google credential, anything that lets a message be sent from a mailbox without its owner's campaign, and anything that lets an unsubscribe be bypassed or forged.

4. What is out of scope

• Vulnerabilities in the third-party services we rely on (Google, Stripe, Resend, MillionVerifier, Cloudflare, our hosting provider). Report those to the provider.
• Denial of service, load testing, or anything designed to degrade the service.
• Spam, phishing, or social engineering of our people or our customers.
• Physical attacks, and attacks that need a compromised device or browser.
• Findings from automated scanners with no demonstrated impact, missing best-practice headers with no exploit, and version disclosure on its own.
• Issues that require a customer to have already been compromised elsewhere.

5. Rules for testing

• Test only against accounts you own. Sign up for a trial and use your own Google account and your own recipient addresses; never touch another customer's data.
• If you reach data that is not yours, stop, record the minimum needed to show the problem, and report it. Do not download, keep, or share it.
• Do not send unsolicited email to real people through the service as part of a test.
• Do not run automated scanning at a volume that could affect other customers.
• Do not modify or delete data that is not yours, and do not attempt to persist access.

6. Safe harbour

Security research carried out in good faith, within the scope above and by the rules above, is authorised. For research that meets those conditions, ColdMerge:

• considers it authorised under applicable anti-hacking and anti-circumvention laws,
• will not pursue or support legal action against you,
• will not pursue a claim under our terms of service for the testing itself, and waives any restriction in those terms that would otherwise prohibit it,
• will make that position clear to any third party who asks, if your research touched a system of theirs while in our scope.

This does not cover research that goes outside the scope, breaks the testing rules, harms customers, or is used to extort. If you are unsure whether something is covered, email us before you do it. We would much rather answer a question than handle an incident.

7. Coordinated disclosure

We ask that you give us a reasonable time to fix a confirmed issue before you publish anything about it. Our default is 90 days from your report, or sooner once a fix is deployed. If we need longer, we will say why and agree a date with you. We will not ask you to keep an issue secret indefinitely.

8. What we do on our side

Some of the standing controls, so you know what you are testing against:

• Google OAuth tokens are encrypted at rest with per-record keys wrapped by a managed key service, held in a separate store, and destroyed when a mailbox is disconnected.
• Every request is scoped to one organization, and a mismatch between the session and the organization named in a request is refused rather than resolved.
• Message bodies are not stored; Gmail remains the system of record for your mail.
• Every change runs through secret scanning, static analysis, dependency and container vulnerability scanning in continuous integration, and dependencies are pinned and installed with a publish-age delay against hijacked releases.

Questions about this page: security@coldmerge.com. For privacy matters, see the privacy policy.