Report a security problem

Last updated: 16 October 2026. This page is written in plain English. It is not legal advice.

PaceFolio keeps people's money figures, so we want to hear about any weakness in it. If you find one, please tell us. You do not need an account to report, and you do not need to give your name.

Permission to test

If you act in good faith and follow the rules below, we treat your research as authorised. We will not take legal action over it, and we will say so if anyone asks. This promise covers PaceFolio only. It cannot cover the companies we rely on.

The rules

• Tell us as soon as you find something.
• Test only with your own account and your own data. Do not open, change or delete anyone else's.
• Use a weakness only as far as you need to show it is real. Do not copy data out.
• If you reach someone else's data by accident, stop, tell us, and do not share it.
• Give us a fair amount of time to fix it before you make it public.
• Please send one clear report instead of many automatic scanner results.

Not allowed

• Attacks that slow down or knock over the service (denial of service).
• Phishing, tricking people, or any physical or non-technical attack.
• Spamming the waitlist, sign-up or feedback forms.

What is covered

The app at app.pacefolio.org and the website at pacefolio.org, including sign-in, passkeys, the saved figures, share links and the owner page.

Not covered: the services we use (Netlify, Supabase, Resend, Anthropic and the free price and exchange-rate sources). A problem in one of them should go to that company. If you are not sure whether something is covered, ask us first.

How to report

Email support@pacefolio.org and put "security" in the subject.

Loading the contact details…

If email does not work for you, open the app, press the Feedback button and write "security" at the start. It goes straight to the owner.

A useful report says where the problem is, what could go wrong because of it, and the steps to repeat it. Screenshots help. English is best.

What you can expect

PaceFolio is a small project run by one person. We aim to reply within 5 working days, tell you whether we can reproduce the problem, and keep you updated until it is fixed. We keep your name and details private unless you say we can share them. We do not run a paid bug bounty. If you would like to be thanked by name once it is fixed, say so in your report.

Our own checks

We have not had an outside security test of PaceFolio yet. We test it ourselves and we say plainly what has and has not been checked on the About page. This page and the machine-readable file at /.well-known/security.txt are how to reach us.

Changes to this page