Available on: Mac, Windows, iOS, Android

Found a security vulnerability in Wispr Flow? This policy explains how to report it, what qualifies for a bounty, and the legal protections offered to researchers who follow responsible disclosure practices.

What this policy covers

This policy is designed to:

How to report a vulnerability

Report security vulnerabilities via email to security@wisprflow.ai.

Note: There is no in-app vulnerability reporting path — researchers must email directly.

Required information

When submitting a report, you must include all of the following. Submissions missing required fields will be returned for completion before triage begins.

Submission quality & original research

Submissions must reflect original, hands-on security research performed by the submitter against Wispr Flow's actual production systems.

Reports that are primarily generated by AI tools without demonstrated manual verification and testing will be closed without review.

Indicators that may result in immediate closure:

Submission limits

Researchers may submit a maximum of 5 bounty-eligible reports per calendar month. Additional submissions beyond this limit will be queued but not eligible for bounty. This limit resets monthly and does not apply to Critical-severity findings.

Response timeline

All timelines below are measured from the acknowledgment date, except remediation targets, which begin after final classification & payout.

Stage

Timeline

Clock starts

Acknowledgment

Within 3 business days

Date report received

Initial triage

Within 10 business days

Acknowledgment

Final classification & payout

Within 30 business days

Acknowledgment

Remediation — Critical

Within 7 days

Final classification & payout

Remediation — High

Within 30 days

Final classification & payout

Remediation — Medium

Within 90 days

Final classification & payout

Scope

In-scope assets

Android note: Limited functionality vs other clients. Core surfaces: dictation, floating bubble, transcript history, account profile. No privacy mode toggle, no in-app subscription, no language selection UI, no dictionary/snippets, no feature flags. Enterprise users have privacy mode auto-enabled server-side.

Out-of-scope items

Infrastructure & third-party

Attack categories

Low-impact / theoretical findings

Rate limiting & brute force

Rate limiting or brute force without a demonstrated complete attack chain resulting in account compromise or data exposure. IP rotation to bypass IP-based rate limits is an inherent limitation of IP-based rate limiting, not a vulnerability. Reports must show end-to-end impact.

Authentication token storage

Token storage in browser localStorage or cookies — this is the default behavior of Supabase Auth. Without a demonstrated XSS chain leveraging stored tokens for session hijacking, this is Informational.

Third-party dependency issues

Vulnerabilities in third-party dependencies without a demonstrated exploit path specific to Wispr Flow. Reporting a CVE without showing exploitability in Wispr's context is not bounty-eligible.

Submission quality

If unsure whether an issue is in scope, report it anyway — Wispr Flow will triage it.

Duplicate reports

Only the first reporter of a given vulnerability is eligible for a bounty. Wispr Flow tracks all reported findings internally. If your submission describes an issue that has already been reported, you will be notified that it is a duplicate and no payout will be issued. If you believe your finding is a novel variant of a previously reported issue, include a clear explanation of how it differs.

Reward and severity guidance

Rewards are based on actual impact, exploitability, and report quality. All awards granted at Wispr Flow's discretion following internal validation.

Minimum bounty eligibility

Bounty payments require a minimum severity of Medium (CVSS 4.0+ or equivalent). Low and Informational findings are accepted and acknowledged but not eligible for monetary reward.

Severity levels

Wispr Flow classifies severity based on what we independently verify, not what the reporter claims.

Informational / Best Practice — $0

  • Missing CAA records, non-critical security headers

  • General security advice

  • Theoretical attacks without demonstrated exploitability

  • Working-as-designed behavior behind proper auth controls

  • Token storage in localStorage without XSS chain

Low — $0 (acknowledgment only)

  • Limited information leakage (non-sensitive data, stack traces)

  • Predictable session tokens with short TTL

  • Minor auth flaws without account takeover

  • Reflected XSS in limited contexts

Medium — $500 to $2,000

  • Authorization bypass on non-sensitive accounts

  • OAuth redirect token theft requiring social engineering

  • CSRF with sensitive state-changing actions

  • Stored XSS requiring victim interaction

  • SSRF reaching internal metadata with mitigations

Wispr example: OAuth redirect_to manipulation leaking tokens to attacker server after victim clicks crafted link.

High — $2,000 to $5,000

  • Authenticated RCE

  • Direct privilege escalation (regular user → enterprise admin)

  • Persistent XSS impacting many users without victim interaction

  • Significant PII exfiltration

Wispr example: Bypassing X-Impersonate-Enterprise middleware to perform write operations as impersonated enterprise.

Critical — $5,000+

  • Unauthenticated RCE in production

  • Full database exfiltration of PII/credentials

  • Active credential leaks enabling large-scale ATO

  • Supply-chain compromise of auto-update infrastructure (dl.wisprflow.com)

Wispr example: Unauthenticated access to Supabase admin API enabling bulk user data export.

Severity decision factors

Partial rewards

Partial reward (lower end of range) may be issued when:

Reports that remain unreproducible after clarification will be closed.

Responsible disclosure

Researchers are asked to avoid public disclosure until:

Standard window: 90 days from acknowledgment

Exceptions: May be shortened/extended if actively exploited or if legal/regulatory obligations require earlier disclosure

If you plan to publish, notify Wispr Flow at least 7 days before public disclosure. When possible, Wispr Flow will publish a coordinated advisory.

Safe harbor and legal protection

If you follow this policy and act in good faith, Wispr Flow will not initiate legal action against you, provided you:

Warning: Wispr Flow reserves the right to deny safe-harbor if testing is reckless, destructive, or violates this policy.

Report template

All fields marked * are required.

FAQs

Are missing CAA records eligible for a bounty?

Informational only — bounty-eligible if combined with real certificate misissuance.

Are subdomain takeovers in scope?

Yes, if the takeover allows control of a Wispr Flow domain (e.g., dangling CNAME).

Are client-side issues eligible?

Yes, if they result in remote compromise or user data leakage beyond expected behavior.

Are Low-severity findings bounty-eligible?

No. As of April 2026, bounty requires minimum Medium severity (CVSS 4.0+). Valid Low findings may receive hall of fame recognition.

Can I use AI tools in my research?

As research assistants, yes. But the submission must reflect hands-on testing you performed. AI-generated reports without manual verification will be closed.

What if my finding is a duplicate?

Only the first reporter is eligible for a bounty. If you believe your finding is a novel variant of a previously reported issue, include a clear explanation of how it differs.

Is there a submission limit?

5 bounty-eligible reports per month per researcher. Critical findings are exempt.

Researcher notes