Security, disclosure and reporting
If you've found a weakness in Pigeon, or someone is using it to hurt people, we want to hear from you.
Report a security vulnerability
Email security@pigeonmessage.io. Please include:
- what you found and where (the app, a server, this website, a specification);
- the steps to reproduce it, and the version you used;
- what an attacker could do with it.
We'll acknowledge your report within 5 working days, keep you updated while we fix it, and credit you when it's fixed if you'd like.
Disclosure policy
Version 1.0, 22 October 2026.
- In scope: the Pigeon apps, Pigeon's servers, this website, and Pigeon's published specifications and cryptographic designs.
- Out of scope: denial-of-service and load testing, spam, social engineering of people, physical attacks, and the systems of our hosting providers (report those to them).
- Test only against your own accounts and devices, or accounts whose owners have agreed. Don't access, change or keep anyone else's data. If you reach someone else's data by accident, stop, don't share it, and tell us.
- Give us time. Please let us fix a problem before you publish it. We aim to fix within 90 days and will agree a date with you; if we need longer, we'll tell you why.
Safe harbor
If you research and report in good faith under this policy, we consider your research authorised. We won't bring legal action against you or report you to law enforcement for it, including under anti-hacking laws or under the terms of service's rules on attacking the service. If someone else brings a claim against you for research that followed this policy, we'll make it known that your work was authorised. This safe harbor covers only what Pigeon can authorise; it can't cover systems we don't own. If you're unsure whether something is allowed, ask us first.
The same contact is published in machine-readable form at /.well-known/security.txt (RFC 9116).
Pigeon is in alpha and hasn't had an independent security audit. The threat model lists the gaps we already know about.
Report abuse
Pigeon doesn't scan or read your messages, so abuse only reaches us when someone in the conversation reports it.
In the app Coming: choose Report on a message and pick what's wrong. You choose which messages to send. The report proves those messages came from the sender's account, without telling us the group, its members, or anything you didn't select. By default it doesn't tell us who you are.
Until then, email abuse@pigeonmessage.io. Don't send screenshots of child sexual abuse material; describe what you saw and where, and we'll tell you what to do next.
What you can report
- Spam or scam
- Harassment or hate
- Child safety
- Violent threats
- Graphic violence
- Terrorism or violent extremism
- Illegal goods and services
- Sexual content I didn't ask for
- Private or intimate content shared without consent
- Suicide or self-harm
- Pretending to be someone
- Copyright or trademark
- Something else
There's also “I just don't want to see this”, which hides the message on your device and sends nothing to anyone.
If someone is in immediate danger, contact your local emergency services first.
What happens to a report
Pigeon's safety team checks that the report is genuine and decides what to do: for example, removing a file from our servers, or suspending the account so it can't reach new people. The acceptable use policy sets out what happens. We keep reports only as long as we need them (see the privacy policy). How reporting works technically: abuse reporting with message franking.