Report a vulnerability

How to report

1. Email security@moraph.comOne report per issue helps us track and fix each one.
2. Tell us what you foundThe affected address or product, what an attacker could do, and the steps to reproduce it. Screenshots, requests and responses help.
3. Give us a way to reach youWe’ll acknowledge your report and keep you informed. Tell us if you’d like to be credited, and how.

Scope

Report anything that could affect the security of Moraph or the data we hold for clients, including moraph.com and the Moraph services on its subdomains (such as the client portal, apps, support, documentation, academy, careers, suppliers, partners, status and this Trust Center).

Some systems Moraph operates belong to clients and may be covered by the client’s own disclosure program. If you’re not sure who owns something, report it to us and we’ll make sure it reaches the right people.

Good-faith research

We will not pursue good-faith research. Good faith means testing only as far as you need to show the problem, not accessing, changing or keeping other people’s data, not degrading our services, and giving us the chance to fix the issue before you share it.

security.txt

Our security.txt (RFC 9116) lists the same contact for automated tools:

Contact: mailto:security@moraph.com
Preferred-Languages: en

This page is for reporting vulnerabilities. For questions about Moraph’s security practices or your review, ask the team; clients with a service problem should use Moraph Support.