Security & disclosure

If you have found a vulnerability in Milda, tell us before you tell anyone else. This page is what /.well-known/security.txt points at.

#How to report

Mail security@mildastudio.com with enough detail to reproduce: the URL or package, the steps, and what an attacker gets. A proof of concept helps; a scanner report without demonstrated impact usually does not.

Please do not open a public issue, and please do not test against other people's projects. If you need an account to demonstrate something, say so and we will set one up.

#What we commit to

We acknowledge within three working days.
We tell you what we found when we have assessed it, including if we disagree that it is a vulnerability, and why.
We credit you when the fix ships, if you want credit. We will not name you if you would rather stay anonymous.
We will not pursue you for research done in good faith under this policy. There is no paid bounty.

#Scope

In scope: milda.studio, milda.app, milda.dev, *.milda.page, and the open-source packages (milda-lang, milda-engine).

Out of scope, unless you can show real impact:

Anything that requires the victim to paste attacker-supplied code into their own browser console.
Missing headers on purely static pages.
Rate limiting on unauthenticated endpoints that do not send mail or cost money.
Reports generated by automated scanners with no demonstrated exploit.

Generated code is yours, and so is its security

Milda emits source into your repository. Once generated, that code lives under your review and your dependency policy - a vulnerability in a library you install alongside it is not something we can patch on your behalf. What we own is the generator, the editor, the registry and the hosted surfaces above.

#Third parties

Milda runs on Supabase, Vercel, Cloudflare, Stripe and Resend. A vulnerability in one of those belongs to that vendor's disclosure programme - report it to them, and tell us too if it affects Milda specifically so we can mitigate while it is fixed.