Report a security problem
If you have found a vulnerability in Ninecast, please tell us. Email support@getninecast.com with Security in the subject. You do not need an account, and you do not need to prove anything first — a description and the steps to reproduce it are enough.
What we will do
We aim to acknowledge a report within three working days and to tell you what we think of it within ten. If it is a real problem we will tell you when it is fixed. If we disagree that it is a problem, we will say so and explain why rather than going quiet.
We do not pay for reports. If you would like credit once a fix is out, say so and we will name you.
What is in scope
getninecast.com and everything under it, including the planner embeds at /e/… and our API routes. Our Airtable extension counts too.
Out of scope: the services we connect to — Notion, Airtable, Canva and the social networks you link — which have their own reporting channels; findings that only report a missing hardening header with no exploitable consequence; and reports generated by a scanner with no evidence of impact.
What we ask while you are testing
Use your own planner and your own accounts. Do not read, change or delete another customer’s data — if you find you can, stop there and tell us; that is the report. Do not run load or denial-of-service tests against production, and do not social-engineer our staff or our customers.
If you keep to that, we will not pursue you for the testing itself, and we will treat your report as made in good faith.