Reporting a vulnerability

We read every report, we do not run a legal-threat playbook, and we will tell you what we fixed and when.

This page is what the Policy field of our security.txt points at. That file is served from our API host at /.well-known/security.txt, and it names the address below.

How to reach us

Write to the security address at the bottom of this page. Tell us what you found, how to reproduce it, and what you think it lets someone do. We acknowledge within two working days, tell you our assessment within ten, and tell you when the fix ships.

What we ask

• Give us a reasonable chance to fix it before you write about it. We do not set a deadline on you; tell us yours and we will work to it.
• Use your own accounts and your own test data. Do not read, keep or send on anyone else’s Responses, Replies or account data. If you come across someone’s data by accident, stop, tell us, and delete what you have.
• No denial of service, no load testing against production, no social engineering of our team or our suppliers, no physical attempts.

If you stay inside that, we will not pursue you, and we will say so in writing if you need it.

In scope

The iPhone app, the API behind it, the website, and the infrastructure that runs them.

Out of scope

Reports produced only by a scanner with no demonstrated effect, missing headers with no exploit behind them, e-mail configuration findings with no delivery impact, and anything that needs a device somebody has already taken over.

What we do not have

There is no bug bounty yet. There is no end-to-end encryption, and we do not claim any: Responses are encrypted in transit and at rest, we do not read them, and a report is the one path by which anyone here opens one. We would rather tell you what the system does than let you discover we overstated it.

Acknowledgement

If you would like it, we will name you here once the fix has shipped.