How to report
Send the report to marius@web-highlights.com. There is no form to fill in and no account to create. A useful report usually has:
- Which surface is affected — extension, web app, or website.
- Steps to reproduce, ideally with a proof of concept. A scanner screenshot on its own is rarely enough to act on.
- What an attacker could actually do with it.
- How you'd like to be credited, if you want credit.
Machine-readable contact details live at /.well-known/security.txt.
What's in scope
- The Web Highlights browser extensions for Chrome, Edge, and Firefox.
- The web app at app.web-highlights.com, including the reader and PDF viewer.
- The website at web-highlights.com.
- The sync API that stores highlights, notes, and tags.
Out of scope
- Denial of service, volumetric testing, or anything that degrades the service for other people.
- Social engineering of users or of the operator.
- Missing hardening headers, weak cipher suites, or similar findings with no demonstrated impact.
- Self-XSS, and issues that need an already-compromised device.
- Vulnerabilities in third-party services we depend on — please report those to the vendor directly.
What happens next
Web Highlights is run by one person, so here is a timeline that is honest rather than flattering:
- Acknowledgement within 5 business days. If you haven't heard back by then, please send a reminder — it means the mail went astray.
- An initial assessment within 10 business days, saying whether we could reproduce it and how we rate the severity.
- A fix timeline that matches the severity. Something actively exploitable gets worked on immediately; a low-impact issue may wait for the next regular release.
- Credit on request once a fix has shipped. We do not run a paid bounty programme — there is no money attached to this, and we would rather say so plainly than imply otherwise.
Please give us a reasonable window to ship a fix before publishing. We won't ask you to stay quiet indefinitely.
Safe harbour
If you research in good faith and follow this policy, we will not pursue legal action against you, and we will treat your report as an authorised contribution to the security of the product. Stay within your own accounts and test data, don't access or modify other people's highlights, and stop as soon as you have proof — then tell us.
Regulatory reporting
Web Highlights GmbH is an EU manufacturer under the Cyber Resilience Act. We maintain an internal procedure for notifying the relevant national CSIRT and ENISA about actively exploited vulnerabilities and severe security incidents, on the regulation's 24-hour and 72-hour timelines. Where an issue affects you, we will also describe it and any action you can take in our release notes.