Report abuse

01What to send

The more of this you can include, the faster it gets resolved.

• The full message headers. These are what identify the sending account; the visible From line on its own often is not.
• The message body, or a screenshot of it.
• The date and time you received it, with the timezone.
• What you believe is wrong with it.

02What happens next

We acknowledge reports and investigate them. Where a report is upheld, the response is proportionate to what happened — from a warning through to immediate suspension of the account.

We will not be able to tell you what action was taken against another customer, which is a limit of data protection rather than a reluctance to act.

03Urgent categories

Reports involving child sexual abuse material, or a credible and immediate threat to someone's safety, are escalated straight away and referred to the appropriate authorities. Mark the subject line urgent and it will be treated as such.

04Reporting a vulnerability

A security flaw in Ruber is not the same thing as abuse from a Ruber address, and it goes to security@ruber.me rather than to the abuse mailbox. This section is the policy referenced by our security.txt.

Tell us what you found, how to reproduce it, and what an attacker could do with it. Give us a reasonable period to fix it before publishing. We will not pursue legal action against anyone acting in good faith under this policy, and we will credit you if you would like to be credited.

There is no paid bounty programme. Saying so is more useful than leaving you to guess.

• In scope: this website, the dashboard, the API when it ships, and the mail plane — SMTP, IMAP and the delivery path.
• Out of scope: reports produced solely by an automated scanner with no demonstrated impact, missing hardening headers with no exploit, and anything requiring physical access or a compromised end-user device.
• Never in scope: testing that degrades service for other customers, or accessing a mailbox that is not yours. Ask us for a test account instead.

05If you are a mailbox provider

If you operate a receiving system and are seeing abuse from our IP space, write to abuse@ruber.me with the affected IP and a sample. We would rather hear from you directly than find out through a blocklist.