FLANTHROPIC / security / responsible disclosure
Security

Responsible Disclosure Policy

Effective 1 June 2026. Custard researchers welcome.

Firm but not hard, wobbly but not wet

We hold every flan to one standard: set but not stiff, firm but not hard, wobbly but not wet. A finding, in our world, is any custard that drifts outside that tolerance. We welcome good-faith reports from anyone who bakes one of our recipes and meets a wobble they did not expect.

What qualifies

Known, will not fix

Tell us the steps to reproduce

Reach us through any channel in the footer with enough to reproduce the fault: the recipe and version, your oven and bake time, and ideally a photograph of the wobble in question. The more detail, the faster the fix.

How we triage

SeveritySymptomResponse
Sev-1Structural collapse, the flan does not stand.Addressed within one bake.
Sev-2The weep, caramel pooling where it should not.Next bake.
Sev-3Minor cracking or a stray skin.Triaged and noted.
Sev-4Cosmetic only, an uneven turn-out.Acknowledged with thanks.

Our commitment

We will not pursue action against anyone testing our recipes in good faith in their own kitchen. Bake freely, report honestly, and we will treat every finding seriously. Researchers who surface a genuine Sev-1 may receive our deepest gratitude and, on occasion, The Ultimate Flan.