Found a way to break something?
Last updated September 3, 2026
Tell me, and I'll fix it. A report lands with the person who wrote the code, because I run Rhapsody on my own.
Email jeff@rhapsodycolor.com and put the word security in the subject, so it doesn't sit behind the rest of my mail. Tell me what you found, how to watch it happen, and what you think it lets someone do. A rough note beats no note.
There's no bug bounty. I'd rather say that now than have you spend a Saturday on this and ask afterward. What you do get is a fast reply from a person, and your name on this page if you want it there.
What happens after you send it
I'll write back within three business days. That's the real number and not one I'm hoping to hit.
Then it goes one of three ways.
- It's real. You'll hear what I'm changing and roughly when.
- It isn't. You'll hear why, with the reasoning rather than a form letter.
- It's real and it belongs to somebody else. I'll say who, and hand it on.
When the fix ships, I'll tell you. Want credit? Send me the spelling.
What's in scope
Three things, and this website:
- Palette, the Figma plugin.
- api.rhapsodycolor.com, which does the color math.
- app.rhapsodycolor.com, which holds accounts and billing.
Some of what Rhapsody runs on belongs to somebody else. Payments go through Paddle, accounts sit in Supabase, and Figma hosts the plugin. If what you found lives in one of those, send it to them first. They'll move on it faster than I can pass it along, and I'd still like to hear about it.
What I'm asking you not to do
None of this should be a surprise.
- No scanners. This is a small setup, and a scanner reads as an attack rather than as research.
- Leave other people's accounts alone. If you need a second account to show me something, make one. They're free.
- No denial of service, and no load testing.
- Give me a chance to fix it before you write it up.
That last one isn't a gag order. Publish what you like once it's fixed, and if you've got a date in mind, tell me and I'll work to it.
What Rhapsody keeps, if that's what you're poking at
The privacy policy has the whole list. Here's the short one. An account holds your email, how you sign in, and your plan status. Palettes you save are kept with it. Your card never reaches me, because Paddle runs the checkout and holds it.
The plugin keeps your working session on your own machine, in Figma's local storage, next to the token that keeps you signed in. Generating a palette doesn't store your colors - it's computed and handed back, with just one log line noting that a generation happened.
Where I am on audits
No SOC 2, no ISO 27001, no audit of any kind. Rhapsody is one person, and saying otherwise would be the first thing on this page you shouldn't trust.
Two things are true underneath that. Card data never enters my systems, because Paddle is the merchant of record and runs the checkout. And the services this is built on keep their own paperwork, which is theirs and not mine to claim.
Contact
jeff@rhapsodycolor.com. I read every one.