HTML version: https://cooperemail.com/security

Security

# Report a vulnerability to the operator.

Email [ops@avatar33.com](mailto:ops@avatar33.com) with the URL, the request you sent, and what you observed. Please give us a chance to fix it before you publish details. There is no paid bug bounty. The machine-readable file is [/.well-known/security.txt](https://cooperemail.com/.well-known/security.txt).

## Controls in the product

- HTTPS on cooperemail.com.
- API keys and OAuth tokens hashed with SHA-256. The plaintext key is returned once.
- A leaked `coop_live_` key can be revoked without an account at [POST /api/v1/keys/report-leak](/docs/leaked-keys). The response does not say whether the key was valid.
- OAuth authorization code flow with PKCE S256 for MCP connectors.
- Inbound from the Cloudflare Worker requires a shared secret.
- Stripe webhooks require a signature from STRIPE_WEBHOOK_SECRET.
- Outbound fails closed when no sending provider is configured and real SMTP is required.

## SOC 2

Cooper does not have a SOC 2 Type I or Type II report. Treat any claim of a Cooper SOC 2 report as false.

[Trust](/trust) · [Abuse](/abuse) · [Privacy](/privacy)