Security — Reporting a vulnerability

If you believe you have found a security issue, email security@rowfold.com with enough detail to reproduce it. We aim to acknowledge within two business days and to tell you what we intend to do about it, and how quickly, within ten. The same address is published in machine-readable form at /.well-known/security.txt (RFC 9116). Safe harbour. We will not pursue or support legal action against anyone who reports an issue in good faith, provided you give us a reasonable chance to fix it before disclosing publicly, do not access, modify, or retain data belonging to anyone but yourself, and do not degrade the service for others. Testing against your own account and workspaces is explicitly welcome. If you are unsure whether something is in scope, ask first — we would rather answer the question than have you guess. Please do not use automated scanners against the production service without telling us; the traffic is indistinguishable from an attack and will simply be rate-limited.