Report a security problem

If you have found a way to read another person's data, act as another account, use a paid tool without paying, or make Cortex run code or send text somewhere it should not, please tell us before telling anyone else. The machine-readable version of this page is at /.well-known/security.txt.

How to report

Email support@cortex-studytool.app with “Security” in the subject. Say what you found, the steps to reproduce it, and what you think an attacker could do with it. If a tool returned a reference code, include it: it lets us find the request in our logs, which do not contain the text anyone submitted.

In scope

The website and its API at www.cortex-studytool.app, and the Cortex Chrome extension. Of particular interest: account takeover, access to another user's usage or licence key, getting around a plan's allowance, the extension typing into or submitting a page it was not asked to, and anything that sends a user's text to a party the privacy policy does not name.

Please do not

Access, change or delete data that is not yours; test against other people's accounts; run load tests, denial-of-service or high-volume automated scanning against production; or use social engineering against anyone. Create your own account to test with, and stop as soon as you have shown the problem exists.

What happens next

We will confirm we have your report, tell you whether we can reproduce it, and tell you when it is fixed. If you act in good faith and within these rules, we will treat your report as help rather than as an attack. Cortex does not run a paid bounty programme.