Safe harbor
We consider security research carried out in line with this policy to be authorised. If you report a vulnerability privately and follow the rules on this page, we will not take legal action against you, report you to law enforcement, or ask a platform to suspend your account because of that research. If your testing accidentally reaches personal data, stop, do not copy or share it, and tell us: we will treat that as part of the report, not as an attack.
We ask for reasonable time to fix the problem before anything is published. We will acknowledge your report within three business days, tell you what we have found and what we plan to do, and keep you updated until it is fixed. We will not ask you to keep a finding secret indefinitely: if we cannot fix it within 90 days, we will agree a disclosure date with you rather than leave you waiting.
This promise covers Unevee and the systems we control. It does not bind third parties such as our hosting, database or email providers, and it does not waive their rights or yours under law. It also does not cover research that breaks these rules, such as accessing other people's data, disrupting the service, or testing without a good-faith intent to report.
What is in scope
We are interested in anything that lets someone do something they should not be able to do on Unevee:
- The website at unevee.com and the API it uses.
- The Unevee Android and iOS apps.
- Accounts and sign-in: taking over an account, bypassing verification, or keeping access after it should have ended.
- Authorisation: reading or changing another person's profile, posts, chats, studio, memberships, check-ins or payment records.
- Uploads and links: getting the server to store or serve something it should not.
- Anything that exposes personal data, secrets or studio verification documents.
How to report
Email security@unevee.com. Include the steps to reproduce the problem, the URL or app version, what you expected to happen, what actually happened, and the impact as you understand it. A short screen recording is often the clearest evidence.
- Use test accounts you created. Do not access, change or download another person's data, and do not use real personal data in your tests.
- Stop as soon as you can demonstrate the issue. Do not leave anything running, do not create persistence, and do not send messages or emails to real users.
- Do not open a public issue, post details publicly, or share the report with anyone else before we agree a disclosure date.
- We do not run a paid bug bounty. We will credit you if you want, and we are grateful for the time you spend.
What happens next
We reply within three business days with a person to talk to and a reference for your report. We aim to confirm or rule out the issue within ten business days, then give you a fix timeline based on severity. If a fix needs longer, we will tell you why rather than go quiet.
When the issue is fixed, we will agree a disclosure date with you. Our default is 90 days after the report, or sooner if a fix ships earlier. We will not publish your details without your permission.
What is out of scope
These are better reported elsewhere, or are not security issues in themselves:
- Third-party services we rely on, such as DigitalOcean, Supabase, Resend, Firebase or Google Maps. Report those to the provider; if Unevee users are affected, tell us as well and we will help coordinate.
- Denial-of-service and volumetric testing, including stress tests against production. Do not run them.
- Social engineering of staff or users, phishing, or physical access to people or premises.
- Spam, bulk account creation, and automated scanner output with no demonstrated impact.
- Reports that only list missing best-practice headers on JSON endpoints, or missing SPF/DMARC records for a domain we do not send from.
Acknowledgments
We thank the researchers who report privately and give us time to fix. With your permission, we list your name or handle here. There are no entries yet.