Updated 11 November 2026
Security
Found a security problem in Mixel? Thank you for looking. Please tell us privately, and we’ll work with you to fix it.
Report a problem
Write to security@0x1audio.com. Please don’t share it anywhere public until it’s fixed.
Tell us:
- what you found, and what an attacker could do with it
- the steps to reproduce it
- the version of Mixel you tested, or for the cloud, the page and the time
- the name to credit, if you’d like credit
What’s covered
Mixel, the app for Mac, and the cloud at cloud.0x1audio.com:
- App permissions: an app running code or reaching the network beyond what it declared and you allowed, or reaching Mixel’s own privileges from inside an app.
- Your files: an app reading or writing a file you didn’t choose, didn’t hand to it, and that isn’t in its own data folder. Symlinks, “..” and other path tricks count.
- Store review: installing an app version that’s different from the one we reviewed, getting an app past review, or showing “Reviewed by Mixel” on something we didn’t review.
- Accounts: taking over an account, a session, a sign-in code or a token; a request from another site that acts as someone who’s signed in; getting around the limits on sign-in attempts; reading someone else’s data.
- Our servers: anything private, like a database, an admin panel or a secret, that anyone can reach.
This website, 0x1audio.com, is covered too, and so are the SDKs and the official apps.
Not covered:
- Denial of service by sheer volume, spam, social engineering and physical attacks.
- Scanner output, or missing headers, without a way to cause harm.
- Bugs in an app by another developer. Tell its developer. If the app gets past the permissions you granted it, that part is ours.
- Bugs in a dependency. Report them upstream, and tell us too if Mixel is affected.
What happens next
| Step | Our target |
|---|---|
| We confirm we got your report | 3 working days |
| We tell you whether we can reproduce it, and how serious it is | 10 working days |
| We fix a critical problem | 14 days |
| We fix a high-severity problem | 30 days |
| We fix anything else | 90 days |
We’ll update you at least every two weeks. When the fix is out, we’ll tell you, and when we write about it we’ll credit you, unless you’d rather stay anonymous. Please keep the details private until the fix is out, or for 90 days, whichever comes first.
We’re small, and we don’t run a paid bug bounty.
Safe harbour
If you research in good faith and follow this page, we consider your research of our app, website and cloud authorised, and it doesn’t break our Terms. We won’t take legal action against you or report you to the police for it. This can’t cover services run by other companies that Mixel uses, such as the sign-in pages run by WorkOS, Link’s checkout, Cloudflare or AWS: follow their own security programmes. If someone else complains about research that followed this page, we’ll confirm you had our permission for our part.
Good faith means:
- Test on your own account, your own data and your own Mac.
- If you reach someone else’s data, stop, don’t keep it, and tell us.
- Don’t slow down or break the service for anyone else, and don’t send spam.
- Give us the time above to fix the problem before you talk about it publicly.
Which versions
Mixel is before 1.0, so we fix security problems in the latest version of the app, and in the cloud. Please check the latest version before you report.