Security — Riftwell

How to report

Email security@riftwell.dev. Tell us what you found, where, and how to reproduce it. A proof of concept helps; a video is fine.

We will not ask you to sign a non-disclosure agreement as a condition of making or discussing a report — we would rather earn your trust than require it.

Please do not open a public issue, post it publicly, or test against other people's accounts or data before we have had a chance to respond.

What we commit to

Acknowledge your report within one business day
Tell you whether we consider it a vulnerability, and why
Keep you informed while we fix it
Credit you when it is resolved, if you want to be credited
Work toward a fix, and toward coordinated disclosure, within 90 days of your report, or on a different timeline if we agree one with you directly

We do not currently run a paid bounty programme.

Scope

In scope: our published applications, this website, and the services our applications talk to. Out of scope: the app stores themselves, and reports that amount to missing best-practice headers with no demonstrable impact.

We cannot authorise research against our providers' own infrastructure, and this policy does not attempt to. Cloudflare, Supabase and Netlify each operate their own systems under their own terms; the safe harbour below covers claims we control, not claims belonging to them. If your research touches one of their platforms directly rather than our use of it, report it to them under their own program.

Good-faith research

If you follow this page — act in good faith, avoid privacy violations and service disruption, only interact with accounts you own or have permission to test, and give us reasonable time before disclosure — we will treat your research as authorised and will not pursue legal action over it.

Safe harbour

We have adopted the disclose.io Safe Harbor terms, reproduced below verbatim, because a shared, independently maintained standard is worth more here than wording we wrote ourselves — and saying so plainly builds more trust than the safe harbour itself.

When conducting vulnerability research, according to this policy, we consider this research conducted under this policy to be:

Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;

Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;

Exempt from restrictions in our Terms of Service (TOS) and/or Acceptable Usage Policy (AUP) that would interfere with conducting security research, and we waive those restrictions on a limited basis; and

Lawful, helpful to the overall security of the Internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.

Note that the Safe Harbor applies only to legal claims under the control of the organization participating in this policy, and that the policy does not bind independent third parties.