Disclosure program
Found a hole?
Tell us first.
Only our security team reads this. We reply within two days and keep you posted until it’s fixed.
- In scope
- app.acme.example, api.acme.example, The iOS app
- Out of scope
- Denial of service, social engineering, reports from automated scanners only
- Rewards
- No cash rewards
- First reply
- Usually within 2 hours this quarter
Safe harbor: if you act in good faith and follow this policy, we won’t take legal action against you.
Test only against your own accounts and stop as soon as you’ve confirmed the issue. Don’t read, change or delete other people’s data. Give us a reasonable time to fix it before you tell anyone. We reply within 2 days.