Report a security problem

What is in scope

• app.hailmo.com
• hailmo.com
• The Hailmo apps for Android and iPhone
• The API behind them

What is out of scope

• Denial of service and load testing
• Spam
• Social engineering or phishing of our staff or our users
• Physical attacks
• Attacks on services we use but do not run (Google, Apple, Stripe, Firebase, our hosting)
• Reports from automated scanners with no demonstrated impact
• Missing best practice headers with no exploit
• Self-XSS
• Clickjacking on pages with no sensitive action
• Problems that need an outdated browser or a rooted or jailbroken device

The rules

• Test only with accounts you own.
• Never access, change or delete other people's data. If you reach someone else's data, stop and tell us.
• Do not degrade the service for other people.
• Give us reasonable time to fix the problem before you publish it. We aim for 90 days at most, and sooner when it is fixed.

Safe harbor

Research done in good faith under this policy is authorized. We will not take legal action against you for it, and we will say so if a third party asks.

How to report

Email security@hailmo.com and include:

• The steps to reproduce the problem
• What an attacker could do with it
• The affected address or app version

Please do not include other people's personal data.

What to expect

• We confirm that we got your report within 3 business days.
• We give you a first assessment within 10 business days.
• We keep you updated until it is fixed, and credit you if you want.

Rewards

We do not run a paid bug bounty yet. For valid, significant reports we may send a thank-you at our discretion.