Argilla Holding B.V. — Unico Security and Vulnerability Disclosure
1. Reporting a vulnerability
Email security@unicomail.app. Please include the app version and macOS version, steps to reproduce, and the impact you see.
We aim to:
- acknowledge your report within 3 business days;
- give you an assessment and expected timeline within 10 business days;
- keep you updated, and credit you when the fix ships if you want.
We aim to ship fixes for critical issues within 14 days and to coordinate public disclosure with you, normally at release or 90 days after the report, whichever is first. Actively exploited issues may be disclosed sooner to protect users.
If a vulnerability is actively exploited, we are legally required to notify the competent CSIRT and ENISA, and to inform affected users, promptly (EU Cyber Resilience Act, Art. 14). That is not a public disclosure, and coordinating with you does not delay it.
2. In scope
- The Unico app for macOS (all supported versions), especially: rendering of hostile mail, the main window and IPC, local storage and keychain use, OAuth handling, the updater, and attachment handling.
- The
unicomail.applicense and update endpoints, and the website.
3. Out of scope
- Attacks that need malware already running as the user, an unlocked logged-in session or root (our threat model does not claim to defend against these).
- Volumetric denial of service, spam, social engineering, physical attacks.
- Vulnerabilities in Google, Paddle, AI providers or the macOS web engine; report those to the vendor (tell us too if Unico should mitigate).
- Missing best-practice headers without a demonstrated impact.
4. Safe harbor
If you act in good faith under this policy, we will not file a complaint or bring a civil claim against you for your research. We cannot bind public prosecutors or other authorities. Good faith means: you test only against your own accounts and data; you do not access, keep or share other people's mail or personal data; you stop and tell us if you encounter it; you don't degrade our services; and you give us reasonable time to fix before disclosure.
We do not run a paid bug bounty. How we handle the personal data in your report is described in our Privacy Policy.
5. security.txt
Our contact details are also published, in the RFC 9116 format, at https://unicomail.app/.well-known/security.txt.