Security and responsible disclosure

Report a Swarmtab vulnerability privately to contact@swarmtab.com. Organization: Jiroven Private Limited (CIN U62012KA2026PTC227033), 1 Parivartana Karunya Col, Byahatti Plot, Hubli Keshwapur, Hubli, Dharwad, Karnataka, India, 580023. Effective date: 29 October 2026.

Report safely

Include the app version, OS, affected component, impact and the smallest reproduction. Use a local test page and accounts you control. Remove tokens, cookies, private page content and personal data. Ask for a secure transfer method before sending sensitive proof.

Do not publish exploit details or credentials in a public issue or ordinary feedback screenshot. Do not access another person’s data, perform destructive tests, interrupt service, or test third-party sites or payment systems without authorization.

Product boundaries

The control server binds to loopback. Agent and window tokens are separate. Human-only settings belong to the window. Saved-space data is sealed with the vault; data helpers restrict local files. Page text remains untrusted even when it looks like an instruction.

If a token may have leaked, stop the affected session and contact the owner through a verified private channel. Do not post the token as proof. Demonstrate a boundary failure without collecting unrelated data.

Coordinated disclosure

Allow a reasonable opportunity to investigate and coordinate a fix before publication. We reply within 5 business days, and we aim to fix confirmed issues within 90 days. Please wait for the fix, or 90 days, before you publish details. We do not offer a bounty or legal safe harbor. Applicable law and third parties’ rights remain.

For setup problems, use Troubleshooting or Support.