Legal

Security

How we protect your account and your page, and how to report a vulnerability. Email security@more.you. We aim to answer new reports within 3 business days.

Last updated:

1. How we protect your account

  • HTTPS everywhere. more.you, the app, the MCP server and published pages are served over HTTPS. Custom domains get a certificate automatically.
  • Sign-in with Google. You sign in with your Google account, so More.You never sees your Google password. Any password stored from an earlier sign-up is kept only as a bcrypt hash.
  • Secure sessions. Sign-in cookies are secure and HTTP-only, so scripts on a page cannot read them.
  • AI connections you control. AI Control connects an assistant through OAuth. You approve each connection, and you can remove it.
  • No secrets in code. Keys and passwords live in AWS Systems Manager Parameter Store.
  • Abuse protection. Rate limits on sign-in and sign-up, and a check that every request that changes data comes from our own site.
  • Payments through Stripe. Card details go straight to Stripe. We never see or store card numbers.

The Privacy Policy explains what data we keep and who we share it with.

2. Report a vulnerability

Email security@more.you and include:

  • a description of the problem and what an attacker could do with it;
  • steps to reproduce it, with any proof-of-concept code or screenshots;
  • where it is, for example more.you, app.more.you or mcp.more.you;
  • your name or handle, if you would like credit.

Please do not put a vulnerability in a public issue, a review or a social media post.

3. Scope

In scope

  • more.you and the subdomains we run, including app.more.you and api-app.more.you.
  • Published pages at more.you/<name> and on connected custom domains.
  • The More.You MCP server at mcp.more.you/api and its OAuth sign-in.

Out of scope

  • Problems in services we use, such as Amazon Web Services, Google, Microsoft, Stripe, OpenAI, Cloudflare and the social networks. Report those to the company that runs them.
  • Problems in AI assistants that connect to our MCP server, such as ChatGPT, Claude and Gemini.
  • Attacks that need physical access to a victim’s device, social engineering of our staff, or denial of service through traffic volume.
  • Problems that are already public.
  • Reports with no way to show real harm.

4. Rules for testing

  • Test only against your own account and your own pages.
  • Do not read, change or delete other people’s data. If you reach it by accident, stop, and tell us what you saw.
  • Do not run automated scans that slow the Service down for others.
  • Do not try to get payment from a page you do not own, and do not use cards you are not allowed to use.

5. Safe harbour

If you make a good-faith effort to follow this policy during your research, we consider your research authorised. We will work with you to understand and fix the problem quickly, and we will not start or support legal action about it.

6. Coordinated disclosure

Give us a reasonable time to investigate and fix the problem before you make it public. Once it is fixed, we are happy to credit you in any public notice.

7. security.txt

We publish /.well-known/security.txt under RFC 9116, with the same contact address and a link to this page.

8. Keep your account safe

  • Turn on two-step verification for the Google account you sign in with.
  • Remove AI assistants and Stripe connections you no longer use.
  • We never ask for your password by email. If an email asks for it, forward it to security@more.you.

Language