Security
Last updated: September 2026
Reporting a vulnerability
Email hello@swooptabs.com with "security" in the subject. Please include what you found, how to reproduce it, and what an attacker could do with it. We acknowledge every report within 5 working days. Machine-readable contact details are at /.well-known/security.txt.
What we'd like to hear about
- The Swoop browser extension, on Chrome or Firefox
- Our backend — the API the extension talks to, and this website
- Anything that would let one person reach another person's account, tab data, or billing information
Please don't run automated scans against our production backend, don't access anyone else's data, and don't degrade the service for other people. Test against your own account. Issues in our third-party providers belong with those providers, but tell us anyway if it affects Swoop.
What happens after you report
- Within 5 working days — we acknowledge your report and tell you whether we can reproduce it.
- While we work on it — we keep you updated, and we'll tell you when a fix ships. Swoop is run by one person, so please allow reasonable time.
- Credit — we're glad to name you when the fix is published, if you want that. We don't run a paid bounty.
What we report onward
Swoop is a product with digital elements under the EU Cyber Resilience Act (Regulation (EU) 2024/2847). From 11 September 2026, if we become aware that a vulnerability in Swoop is being actively exploited, or of a severe incident affecting the security of the product, we are required to notify the CSIRT designated as coordinator and ENISA — an early warning within 24 hours, a fuller notification within 72 hours, and a final report after that.
We will also tell affected users directly, and say what you can do to protect yourself. Reporting to us does not put you under any obligation, and we will not name a reporter to authorities without asking first.
How Swoop is built
Some context that may save you time. Free-tier classification runs entirely on your device. The extension requests a narrow permission set and none of the broad ones — no <all_urls>, no webRequest, no history — and private windows are excluded on both browsers. Query strings and fragments are stripped from URLs on your device before any tab data is sent for classification. The one exception is a URL you choose to attach to a feedback report: that is sent exactly as it is shown to you, which is the point of showing it. Database access is default-deny at the row level. What we collect, and where it goes, is in our Privacy Policy.