Report the problem, not the secret.

What to include

Enough detail to reproduce safely.

Include the affected m3lytsz surface, version/build if known, steps to reproduce, observed impact and the minimum evidence necessary. Redact unrelated personal data. Do not email credentials, private keys, recovery secrets, passkey private material or live device secrets.

Research boundaries

Avoid harm.

Do not use destructive testing, denial of service, social engineering, credential attacks, persistence, mass data access, privacy-invasive collection or testing against accounts you do not control. Stop if you encounter private user content or evidence that continued testing could cause harm.

Current capability truth

One encryption boundary; no carrier downgrade.

Private messaging currently uses release-gated m3ly-mls-v1 encrypted envelopes with no plaintext fallback and is not presently claimed as qualified end-to-end encryption. Recipient-bound Message Links/guest sessions are bounded and restricted. Android Bluetooth and Wi-Fi Direct delivery plus QR/NFC offline bootstrap exist in the hardware-beta candidate and remain blocked from production qualification until their exact release gates and physical checks pass. NFC is bootstrap/share only and never a general message carrier.

Web uses the Internet route and supported Web Bluetooth where the browser genuinely provides it; browser Wi-Fi Direct/NFC is not fabricated. Voice messages and audio-only 1:1 calls are active m3lytsz private-beta capabilities: signalling is carried inside authenticated encrypted m3lytsz application messages. Internet call media uses WebRTC with relay-only TURN transport so private peer IP addresses are not exposed. Android offline calls use a separate M3V2 route with explicit bilateral call consent, Bluetooth peer discovery and private/local Wi‑Fi Direct host candidates only; no public candidate or Internet fallback is permitted. Voice v1 is active for controlled Light-BETA testing in the United Kingdom. Voice remains unqualified until exact-build cross-device, wake/background, privacy, relay and physical two-device acceptance gates pass. General radio/accessory, cellular/satellite-capable and external-platform message routes remain unavailable/unqualified unless separately reviewed and released.

Normal candidate service traffic is protected by the canonical m3lytsz edge boundary; direct-backend interactive calls are designed to fail closed after the signed-edge deployment is fully staged. Account-security/deletion/revocation rights remain separately available.

m3lytsz Vault security boundary

Encrypted before upload.

Private messages use the release-gated m3ly-mls-v1 encrypted-envelope path and are not presently claimed as qualified end-to-end encryption. m3lytsz Vault is separate: supported clients encrypt Vault files on the user device before upload, and the storage layer receives ciphertext rather than plaintext file contents.

Vault access can be revoked to stop future key delivery. Revocation cannot erase a plaintext copy that an authorized recipient already decrypted or exported. Cloud backup replication remains a ciphertext-only disaster-recovery layer and is not a second writable production authority.

m3lytsz does not claim independent cryptographic review of Vault until such a review has actually completed. Vault remains release-gated while storage, cross-device interoperability, deletion, recovery and exact-build qualification are completed.

Abuse & privacy

Minimise what you disclose.

Reports of spam, phishing, impersonation, privacy abuse or machine-account deception can be sent to hello@m3ly.me. Private-message reports do not include decrypted content by default; disclose an excerpt only when necessary and intentional.