Legal

Report a security issue

ResearchCal is a small service run by one person. If you find a security weakness in the website, the calendar feeds, the email flows or the AI assistant connector (mcp.researchcal.com), please tell us. This page is the policy that our security.txt file points to.

What to report

• Access to calendar feeds, account data or admin pages without the right token or sign-in.
• Injection, cross-site scripting or other input handling faults.
• Leaks of personal data, feed tokens or sign-in links.
• Faults in the AI assistant connector that expose data or let a client change data.
• Faults in our email handling, such as spoofing or open redirects.

We do not need reports about missing security headers with no shown effect, rate limits, version disclosure, best-practice notes without a working example, or faults in third-party services (Railway, Cloudflare, Resend) that we do not operate. Report those to the provider.

Where to send it

Email [email protected]. Describe the fault, the steps to repeat it and the possible effect. Include the URL and the time of your test, so that we can find the request in our logs. Do not send personal data of other people. If you came across such data, say what you saw and delete your copy.

What we do

• We confirm receipt within 5 working days.
• We tell you whether we accept the report and what we plan to do within 15 working days.
• We aim to fix a confirmed fault within 90 days. We keep you informed if a fix takes longer.
• If you want, we name you on this page when the fix is live.

ResearchCal does not pay bounties or rewards. We are grateful for each report and say so in writing.

Rules for testing

• Use only accounts and feeds that you made yourself.
• Do not read, change or delete data of other users. Stop as soon as you have shown the fault.
• Do not use denial-of-service, spam, social engineering or physical attacks.
• Give us a reasonable time to fix the fault before you tell others about it.

If you follow these rules and act in good faith, ResearchCal regards your research as authorised. We will not take legal action against you for it and we will not report it to the authorities. If a third party starts legal action against you for research that followed these rules, we will make clear that you acted with our permission.

Other questions

For questions about your personal data, see the privacy notice. For all other questions, use the contact form.