Security at mumus

Bug reports often contain screenshots of unreleased work and client data. This is how we protect them.

Accounts

• Passwords are hashed with Argon2id, at least 12 characters, and leaked passwords are rejected.
• Two-factor authentication (TOTP plus backup codes). Organizations can require it for all members.
• Login throttling, session timeouts and generic error messages (no account enumeration).

Access control

• Roles per organization and per project (viewer, reporter, contributor, manager). Clients can be limited to their own reports.
• Screenshots, videos and files are stored outside the web root and are only delivered after login to people with access to that project.
• Uploads are checked by content, images are re-encoded (removes hidden payloads and location data).

Browser extension

• Least privilege: no access to any website until you allow it for a project website.
• No remote code and a strict content security policy. The login token stays in the extension's background process.
• Secrets in URLs, console logs and network logs are redacted before a report is sent.

AI assistants (MCP)

• Separate, scoped tokens: read-only by default, optionally limited to selected projects, revocable at any time.
• No delete tools. Every change is labelled in the task history.

Infrastructure

• TLS everywhere with HSTS, a strict content security policy and anti-framing headers.
• Hosting and backups in the EU. Dependencies are checked for known vulnerabilities.

Reporting a vulnerability

Please e-mail [security@mumus.app]. We respond within two working days and don't take legal action against good-faith research. See also security.txt.