Security

We build security tools, so we take reports about our own security seriously. If you’ve found a vulnerability, thank you. Here’s how to tell us about it.

How to report

Email security@whotechnologies.com with:

• what you found and where (URL, app version, or repository and commit)
• steps to reproduce it, or a proof of concept
• what an attacker could do with it
• how you’d like to be credited, if at all

The same address is listed in our security.txt (RFC 9116).

What’s in scope

• whotechnologies.com and its subdomains
• apps we publish
• code in the WhoTechnologies GitHub organization

Out of scope: denial-of-service testing, social engineering of our team, physical attacks, spam, and automated scanner output with no demonstrated impact.

What we ask

• Act in good faith, and only access the minimum data needed to show the problem.
• Don’t degrade our services or anyone else’s.
• Give us a reasonable chance to fix it before you publish. We suggest 90 days, and we’re happy to coordinate a date with you.

What we promise

• We’ll acknowledge your report within 5 business days and keep you updated.
• We won’t pursue legal action against good-faith research that follows this policy.
• With your permission, we’ll credit you when the fix ships.

We don’t run a paid bug bounty yet.