Moro

Trust center

Security

Report a security problem privately so we can investigate it without putting other Moro users at risk.

Last reviewed August 20, 2026

Private reporting

Found a vulnerability?

Email the report instead of opening a public issue. Never include a real password or access token.

Email a private report

Project security

Protect the app and its users.

We review reports across Moro’s app, extensions, encrypted push relay, and website, then prioritize fixes according to user impact.

In scope

What to report

  • The Moro iOS app and its extensions.
  • The encrypted push relay operated for Moro.
  • This website and its consent controls.

Please do not test accounts, Mastodon servers, or Apple services that you do not own or have permission to assess.

A useful report

Help us reproduce it safely.

  • Affected Moro feature and account context
  • iOS version and device model
  • Reproduction steps using test data
  • Expected impact and any suggested mitigation

Coordinated response

What happens after you report.

  1. 01Acknowledgement

    We aim to acknowledge a complete report within three business days.

  2. 02Triage

    We verify scope and impact, then keep the reporter informed as the investigation progresses.

  3. 03Resolution

    We coordinate a fix and public notice when disclosure helps users update safely.