Wispr Flow (available on Mac, iPhone, Windows, and Android) lets you speak naturally and see your words perfectly formatted with no extra edits, no typos.
Please visit the official website for the latest information.
Wispr Flow Vulnerability Disclosure & Bug Bounty Policy
Found a security vulnerability in Wispr Flow? Please report security vulnerabilities via email to
security@wisprflow.ai.
Researchers may submit a maximum of
5 bounty-eligible reports per calendar month. Additional submissions beyond this limit will be queued but not eligible for bounty. This limit resets monthly and does not apply to Critical-severity findings.
Scope
- Domains: *.wisprflow.ai and associated production domains/subdomains (excluding roadmap.wisprflow.ai — third-party hosted, see Out-of-scope)
- Production backend APIs: api.wisprflow.ai and dl.wisprflow.com (auto-update CDN)
- Production backend dependencies: Supabase (*.supabase.co) and Baseten (*.api.baseten.co) are backend dependencies, though these are third-party hosted services
- Client applications: Electron, macOS, Windows, iOS, and Android clients — issues affecting confidentiality, integrity, or availability beyond normal user operation
- High-impact issues: Auth/authz flaws, data leakage, RCE, cryptographic misuse, serious misconfigurations, client-side enforcement bypasses where server-side validation is absent, auto-update supply-chain integrity
- Infrastructure: Servers, containers, production databases, public S3 buckets, public cloud services
