Responsible Disclosure Policy

• prothopic.io and its subdomains;
• every product we operate, including its websites and its web and mobile apps;
• the APIs and backend services those products use.

Vulnerabilities in a third-party service we use (for example our hosting or payments providers) should be reported to that provider, though we're glad to hear about them too.

Email legal@prothopic.iowith “Security” in the subject line. Please include:

• what you found and where (URL, endpoint or screen);
• step-by-step instructions to reproduce it;
• what an attacker could do with it;
• how you would like to be credited, if at all.

Our machine-readable contact details are at /.well-known/security.txt.

• Only test against accounts you own or have created for the purpose. Don't access, change or delete other people's data. If you reach it by accident, stop, don't keep a copy, and tell us.
• Don't degrade the service for others: no denial-of-service or load testing, and no spam.
• No social engineering of our staff or customers, and no physical attacks.
• Give us a reasonable time to fix the issue before telling anyone else about it.

• Acknowledge your report within 3 business days.
• Keep you updated while we investigate and fix it.
• Credit you publicly once it's fixed, if you would like that.
• Not take legal action against you, or ask anyone else to, for research carried out in good faith and in line with this policy.

We don't run a paid bug bounty at the moment.

Unless you can show a real impact on users or their data, we don't treat these as vulnerabilities:

• missing security headers or cookie flags on their own;
• clickjacking on pages with no sensitive action;
• email SPF, DKIM or DMARC configuration findings;
• reports produced only by automated scanners;
• attacks that need a compromised device or physical access.