Security and responsible disclosure policy

Last updated: 5 August 2026.

Report a security issue in howsafeismyapp

Email security@howsafeismyapp.com. If that mailbox is not yet active, use hello@howsafeismyapp.com with the subject SECURITY. Include the affected URL, impact, reproduction steps, and only the minimum evidence necessary.

Please do not include personal data, credentials, private keys, or database rows in the first message. We will provide a secure channel if needed.

Safe-harbour expectations

We welcome good-faith research that:

• concerns systems we operate, not customer or third-party websites;
• uses only the minimum testing needed to demonstrate the issue;
• avoids privacy violations, persistence, social engineering, spam, denial of

service, data destruction, automated high-volume scanning, and accessing more data than necessary;

• stops immediately if personal data or secrets are encountered;
• keeps the issue confidential until we have had a reasonable opportunity to

investigate and remediate; and

• complies with applicable law.

Where you act in good faith and follow this policy, we do not intend to pursue legal action merely for that research. This statement cannot authorise testing of infrastructure owned by our hosting or payment providers and is not a bug bounty promise.

What you can expect

We aim to acknowledge a report within three business days, provide an initial assessment within ten business days, and keep you informed of material progress. Timelines may vary with severity and third-party dependencies. We do not promise payment, but may credit reporters with permission.

Critical findings discovered by our scanner

Our passive scanner may occasionally identify a potentially serious issue on a submitted third-party website. We preserve only redacted technical evidence, avoid accessing further data, and do not publish or exploit the issue. Where a notification is appropriate, it is factual, confidential, and sent without a sales threat. Legal or law-enforcement escalation is reserved for situations where required by law or necessary to address an imminent serious risk.