Security

Found a vulnerability? Write to security@mementote.co. We read every report and reply within three business days.

Please

Tell us what you found and how to reproduce it.
Give us reasonable time to fix it before you publish.
Don’t access other people’s data, films or request links, degrade the service, or test camera-owner links you weren’t sent.

We won’t pursue good-faith research that follows these rules.

A strict content-security policy. The only outside script is Google’s sign-in (Firebase and reCAPTCHA), and only where you sign in.
No passwords to steal: you sign in with a code texted to your number. The session is a signed cookie; your number is never stored.
Owner links are single-request, expiring, revocable and rate-limited.
Uploads go to encrypted storage and are scanned before processing.
Films play through short-lived signed links after a fresh sign-in.
Audit logs for organization accounts in the owner portal.