Security and disclosure

How to report a vulnerability

Email security@refari.co with one issue per email. Write in English if you can. There is no encryption key for this address yet, so don’t send anyone else’s personal data: describe it instead.

What to include

• What the problem is and what someone could do with it.
• The URL, API route or extension feature affected.
• Steps to reproduce it, with a proof of concept if you have one.
• The accounts you used, and whether you saw anyone else’s data.
• The name you’d like to be credited under, if any.

What to expect

• Refari aims to acknowledge your report within 3 business days.
• Within 10 business days, you’ll hear whether the issue is confirmed and how serious it is.
• While a fix is in progress, you’ll get an update at least every 14 days.
• Refari tells you when it’s fixed, and agrees with you when you can publish.

In scope

• vidler.ai and its subdomains, including the watch, embed and share pages.
• Custom share domains that customers point at Vidler, for Vidler’s own pages on them.
• The public API (/api/v1), webhooks, the MCP server and the Record SDK.
• The Vidler Chrome extension and the phone recorder pages.

Where to look first

• Seeing or changing another workspace’s videos, comments, transcripts or settings.
• Getting round a video’s password, link expiry, embed allowlist or download setting.
• Getting round a workspace’s two-factor, single sign-on or IP allowlist rules.
• Leaked storage links or keys, or links that keep working after they should stop.
• An API key doing more than its read, write or admin access allows.
• Webhooks, embeds, previews or feeds that reveal more than the video’s sharing allows.
• Flaws in the extension’s permissions or in how it passes messages to pages.
• Sign-in, session and account takeover problems.

Out of scope

• Denial of service, load tests and anything that degrades Vidler for others.
• Social engineering, phishing and physical attacks on Refari, its staff or its customers.
• Reports from automated scanners with no demonstrated impact.
• Missing security headers, cookie flags, or SPF, DKIM and DMARC settings, without a working exploit.
• Self-XSS, and clickjacking on pages with no sensitive action.
• Missing rate limits on actions that don’t involve sign-in, money or sending messages.
• Problems that only affect outdated or unsupported browsers.
• Vulnerabilities in the services Vidler uses, such as Cloudflare or Hetzner. Report those to the company concerned. The subprocessors page lists them.
• Other Refari products. This policy covers Vidler only.

Known and intended behaviour

• Anyone with a video’s link can watch it when it is shared as “Anyone with the link”, and anyone can find public videos.
• Shared videos show their title, owner’s name and thumbnail in link previews and oEmbed, unless the workspace turns outside links or embeds off.
• Viewers who aren’t signed in are counted with a random identifier kept in their browser.
• The embed script, the oEmbed endpoint and the Record SDK script are public.
• A share link’s ID is random, and it is the only secret for “Anyone with the link” videos.

Rules for testing

• Use only accounts and workspaces you created yourself. Create as many test accounts as you need.
• Stop as soon as you can show the problem. Don’t go further into systems or data than you need to.
• If you reach someone else’s data, stop, don’t keep or share it, and say so in your report.
• Don’t delete or change data that isn’t yours, and don’t disrupt the service.
• Keep the details private until the issue is fixed or 90 days have passed, whichever comes first, unless you agree another date.
• Don’t ask for payment in exchange for the details.

Safe harbour

When you research and report in good faith and follow this policy, Refari considers your research authorised. In particular:

• Refari won’t start or support legal action against you for accidental, good-faith breaches of this policy.
• Refari waives the parts of its terms of service that would forbid this research, for this research only.
• If someone else brings a claim against you for research that followed this policy, Refari will make it known that you followed it.

This policy can’t bind other companies. If you aren’t sure whether something is allowed, ask at security@refari.co before you try it.

Recognition

Vidler doesn’t run a paid bug bounty. With your permission, people who report valid issues are credited on this page once the fix is out.

Machine-readable contact

The same contact details are published at /.well-known/security.txt, in the standard format (RFC 9116). For how Vidler protects data day to day, see the trust centre.

Changes to this page

• 16 October 2026: First draft, for legal review.