Responsible Disclosure

Helping keep Mosaic safe and secure for everyone.

Responsible Disclosure

Last Updated: Mar 2026

At Mosaic, we care deeply about the safety and security of our customers' data. We greatly value input from our community that can help us detect vulnerabilities in our products and services.

How to report an issue

If you have discovered an issue or vulnerability that is in-scope (see below), please send an email to security@mosaic.so with the following details:

  • A summary of the vulnerability and potential impact
  • Steps to reproduce the issue, including screenshots
  • Details of your environment including OS, browser, and device details
  • If possible, proof-of-concept code to exploit the vulnerability

Upon receiving your email, our team will conduct an investigation. We will update you on our progress and may request further details or retesting of the finding if needed.

All original reports will be considered, and bounties may be issued at our sole discretion.

In scope

  • https://mosaic.so
  • https://edit.mosaic.so
  • https://api.mosaic.so
  • Mosaic integrations and apps
  • Vulnerabilities which apply to Mosaic's hosted platform and customers' projects. Do not attempt to reproduce or exploit these vulnerabilities on customer projects without express permission and communication from the customer and Mosaic teams.

Out-of-scope

  • Automated scanning
  • Social engineering, particularly involving Mosaic employees
  • Missing or insufficient rate limiting
  • Missing headers in responses, except in cases where material harm or exploitation is evident
  • Brute force attacks
  • DDOS attacks
  • Clickjacking on pages with no sensitive actions
  • Theoretical attacks without proof of exploitability
  • Attacks requiring physical access to a victim's device
  • Attacks requiring interception of a valid user's network traffic
  • Denial of service attacks

We kindly ask you

  • Test the vulnerability on your own account. If testing on another account, make sure to have requested explicit permission.
  • Do not copy or destroy production data.
  • Do not engage in activities that will cause downtime for our services.
  • Avoid violations to our privacy policies, terms of service, and other data privacy regulations.
  • Do not make the vulnerability public before reporting it to us via the procedures above, and giving us enough time to properly address the issue.

Report Format

  • Reports must be made to security@mosaic.so
  • Reports must include a summary of the vulnerability and potential impact, including a calculated CVSS score and how you arrived at that score.
  • Reports must include steps to reproduce the issue, including screenshots. Video-only recordings are insufficient.
  • Reports must include details of your environment including OS, browser, and device details.
  • Reports must include proof-of-concept code or any payloads used to exploit the vulnerability.

Risk Assessment and Bounties

  • Risk assessment and bounties will be determined on a case-by-case basis by our security team, leveraging the CVSS v3 and v4 scoring system with internal knowledge of our systems to accurately inform the assessment.
  • Previous bounty amounts, from Mosaic or other bug bounty programs, are not to be considered precedent when determining bounty amounts.
  • Bounty amounts and payments, if any, are subject to change at our sole discretion, and will be communicated to you via email.
  • Bounties will be paid in US dollars, via PayPal Goods & Services.
  • Bounties will be paid out within 30 days of the vulnerability being retested and remediation confirmed.