Security policy
How to report a security vulnerability in M3U.Click, what is in scope, and what you can expect from us.
Last updated 2 November 2026
We take the security of M3U.Click seriously. If you find a vulnerability, please tell us privately so we can fix it before anyone else can misuse it.
How to report
Email support@tibrcode.com with the subject line “Security”. Please include:
- what you found and where (address, page or feature);
- the steps to reproduce it, and the browser and device you used;
- what an attacker could do with it.
Our machine-readable contact details are in /.well-known/security.txt. You can write in English or Arabic.
What to expect
- We confirm receipt within three working days.
- We keep you informed while we investigate and fix the problem.
- With your permission, we thank you by name once it is fixed.
We do not run a paid bug bounty.
Scope
In scope: the website at m3u.click and its subdomains, the editor at m3u.click/app/, and the installable web app. Examples of issues we care about: code that runs in the editor without the user’s intent, ways to read a user’s playlists or backups, weaknesses in backup encryption, and bypasses of our Content Security Policy.
Out of scope: the services we use (report those to Vercel or Cloudflare directly), streams and servers listed in people’s own playlists, social engineering, physical attacks, and reports from automated scanners without a demonstrated impact.
Please do
- test only with your own data and your own playlists;
- stop and contact us if you reach data that isn’t yours;
- give us reasonable time to fix the problem before you publish anything.
Please don’t
- run denial-of-service tests or send large volumes of automated requests;
- try to access other people’s devices or data;
- use a vulnerability beyond what is needed to show that it exists.
Good-faith research ⚖️
We will not take legal action against people who report vulnerabilities in good faith and follow this policy. ⚖️
Contact
support@tibrcode.com, subject “Security”.