Email hello@sendbeam.io with "security" in the subject. Please do not open a public issue for anything exploitable.

Tell us what you found, how to reproduce it, and what an attacker could do with it. We will confirm receipt within two business days and tell you what we intend to do about it. If you would like credit, say so and we will name you when the fix ships; if you would rather stay anonymous, that is fine too.

We do not run a paid bug bounty.

This repository contains tutorial material only — importable workflows, code snippets and written walkthroughs. The reports that matter here are things like:

• a tutorial that teaches a pattern which is unsafe to copy
• a workflow or snippet still carrying something real: a credential, a webhook URL, an id belonging to a live account
• a walkthrough that tells you to grant broader access than the tutorial actually needs

Vulnerabilities in the SendBeam service itself belong in the same inbox, but they are not about this code. If you have found something in the API, the dashboard or the app, say so in the email so it reaches the right place quickly. The published policy is at https://sendbeam.io/legal/security.

It happens. Revoke it rather than quietly deleting the comment — a key that has been public stays public. In SendBeam: Settings → API keys → Revoke, then create a replacement and move anything built on the old key across to it.

Two habits make that rare. Give a key only the permissions its workflow actually uses, and name it after where it runs, so there is never a question about which one to pull.