Security

Report a vulnerability

Email security@vitalmacro.com. The same address is in our security.txt. Please do not use the public support address for this, and do not post the details in public before we have had a chance to fix them.

A useful report says:

• what you found and where (the address of the page, or the app version and phone)
• the steps to repeat it, as short as you can make them
• what you think an attacker could do with it

We read every report and reply to say whether we can repeat it. Vital is made by a very small team, so we do not promise a reply time. English is best.

What is in scope

• vitalmacro.com, this website.
• api.vitalmacro.com, the server that the Vital app and the sign-up forms talk to.
• The Vital app for Android, from the beta or from Google Play once it is there.

Out of scope:

• Other sites we link to or use, such as USDA FoodData Central, Open Food Facts, Google Play and the AI services a person connects with their own key. Report those to their owners.
• Attacks on people: phishing or pressuring our users or us, and anything physical.
• Floods of requests, load tests and anything meant to knock the service over.
• Tool output with no working example, and reports that only say a header or DNS record is missing, with no way to use it.

Please

• Test only with accounts you made yourself. Do not look at, change or delete anyone else's data. If you reach it by accident, stop and tell us.
• Stop once you have shown the problem. Do not copy data out, and do not keep it.
• Keep the traffic small. The sign-up form allows about five requests in a burst and then one every 12 seconds per address, and it will answer with an error if you go faster.
• Give us a reasonable time to fix it before you publish anything.

If you do those things

We do not want to punish people who help us. If you act in good faith and keep to this page, we will not take action against you or report you for it. This is a plain statement of intent, not a contract and not legal advice, and it cannot speak for anyone else, such as your internet provider or the owners of other sites.

Vital does not run a bug bounty and does not pay for reports. We will say thank you, and we will credit you by name once the problem is fixed if you want that.

What this website collects

• On the sign-up forms: the email address you type, a short tag for which form it was (for example website or android-beta), the tag from the link you came by if it had one (?ref=), and the time. A random code is added so the unsubscribe link in each message works. The list stores nothing else about you, and no IP address.
• Nothing else. The site sets no cookies, has no analytics, no advertising code, no tracking pixels and no embedded content from other companies. Every file on a page comes from vitalmacro.com. The only request the pages make to another address is the sign-up form sending to api.vitalmacro.com when you press the button.
• In your browser only: if you use the theme button, your choice (light, dark or automatic) is kept in your browser's local storage so the next page matches. It is never sent anywhere.
• The calculators run in your browser and send nothing.

As with any website, your IP address is visible to our server and to the company that hosts it when you load a page. The sign-up service uses the address to slow down someone who sends many requests at once, and does not put it in the list. The app has its own, longer rules: see the Privacy Policy.

How the site is built

The website is a folder of plain files. There is no login, no database behind the pages and no account on the website. It is sent with a strict Content Security Policy, so the browser only runs scripts and loads styles and images that come from vitalmacro.com, and refuses to be shown inside another site's frame. The pages are only served over HTTPS.

That is how we set it up, not a promise that nothing can go wrong. If you find a way around it, we want to hear about it.