Security
Report a vulnerability to the operator.
Email ops@avatar33.com with the URL, the request you sent, and what you observed. Please give us a chance to fix it before you publish details. There is no paid bug bounty. The machine-readable file is /.well-known/security.txt.
Controls in the product
- HTTPS on cooperemail.com.
- API keys and OAuth tokens hashed with SHA-256. The plaintext key is returned once.
- A leaked
coop_live_key can be revoked without an account at POST /api/v1/keys/report-leak. The response does not say whether the key was valid. - OAuth authorization code flow with PKCE S256 for MCP connectors.
- Inbound from the Cloudflare Worker requires a shared secret.
- Stripe webhooks require a signature from STRIPE_WEBHOOK_SECRET.
- Outbound fails closed when no sending provider is configured and real SMTP is required.
SOC 2
Cooper does not have a SOC 2 Type I or Type II report. Treat any claim of a Cooper SOC 2 report as false.