Reporting a problem

Email [email protected] with Security in the subject. Say what you found, how to reproduce it, and what you think someone could do with it. A person reads every message and you will get a reply within three working days.

Please give us a reasonable chance to fix it before you tell anyone else. We will keep you posted while we do, and credit you when the fix ships if you would like that.

What is in scope

• The Mynato app for the Mac.
• This website, mynato.app.
• The service behind it at mynato.app/api, which handles licences and email.

Payments are handled by Paddle, who have their own reporting process. If you find something there, tell them, and feel free to let us know too.

Testing in good faith

If you look for problems honestly, we will not take action against you. That means: only use accounts and licences that are yours, do not read or change anyone else's data, do not try to slow the site down or knock it over, and stop and tell us as soon as you find something.

There is no paid bug bounty yet. Mynato is small and run by one person, and we would rather say so than promise one we cannot fund.

How Mynato is built

• Your voice is turned into text on your Mac. Recordings and transcripts are never sent to us or anyone else.
• The app's local API only listens on your own Mac and needs its own key for every request.
• The app is signed with an Apple Developer ID and checked by Apple before it is handed out.