Report a security problem

• What you found.
• The product and version. In Jix, open Settings, then About.
• The steps to see it.
• What an attacker could do with it.
• Screenshots or a short video, if you have them.

Please don’t put other people’s personal data in the report.

We reply within 3 business days to say we got it. We check it, tell you whether we can reproduce it, and keep you posted until it is fixed. We aim to ship a fix for a confirmed problem within 90 days, and faster when people are at risk.

Fixes for our Mac apps go out as signed updates through the app’s built-in updater. When a fix is out, we’re happy to thank you by name, if you want that.

Tell us before you publish, and give us 90 days to ship a fix, or less if we agree on a date together. If someone is already attacking users with the problem, tell us right away. We move faster on those.

We won’t take legal action against research that follows this page:

• You test only against your own copy and your own accounts.
• You don’t access, change or keep other people’s data.
• You don’t disrupt our services.
• You stop and tell us as soon as you find a problem.

Don’t use social engineering, spam or denial-of-service tests.

• Problems in other companies’ services, such as OpenAI, Anthropic, Google, Lemon Squeezy or Vercel.
• Reports from automated scanners with no working example.
• Missing best-practice headers with no real impact.

If a problem is in a part we bundle, like the Codex CLI or Claude Code inside Jix, still tell us. We will pass it on and ship an update.

We don’t run a paid bug bounty right now.