Reporting a security problem

Email support@storiefied.com with what you found, how to reproduce it, and what an attacker could do with it.

We reply within three working days and keep you updated until it is fixed.

• Test only against accounts and workspaces you own.
• Do not read, change or delete other people's stories, footage or data; stop and report if you reach any.
• Do not run denial-of-service, spam or social-engineering tests, and do not test published customer sites on their own domains.
• Give us reasonable time to fix the problem before telling anyone else.

• The application: sign-in, the dashboard, the story editor, publishing and custom domains.
• The API and the MCP server, including API tokens.
• Isolation between workspaces.

We will not pursue anyone who reports in good faith and follows this page. We do not run a paid bounty programme today; we are glad to credit you once the fix ships, if you would like that.