Responsible disclosure

In short. Email security@regimate.app with the details. Test only against your own accounts, don't access or keep other people's data, and give us a reasonable chance to fix the issue before you publish. If you do that in good faith, we won't take legal action against you.

1. In scope

• my.regimate.app, including the web app, Enterprise portal, developer portal, help centre and API
• The Finder API and webhooks
• The Regimate apps for iPhone and Android
• regimate.app, this website

We're especially interested in anything that could reveal an owner's or finder's identity or location, access another user's items, messages or Emergency Access portal, bypass authentication or authorisation, or forge signed links or webhooks.

2. Out of scope

• Denial-of-service or load testing, and anything that degrades the service for others
• Social engineering, phishing or physical attacks against our staff, users or offices
• Spam, or sending messages to real owners, finders or keyholders
• Findings in third-party services we use, which should be reported to those providers
• Reports from automated scanners without a demonstrated, exploitable impact
• Missing security headers, cookie flags or best practices without a demonstrated impact
• Self-XSS, clickjacking on pages with no sensitive actions, and issues needing an outdated browser or a compromised device

3. Testing rules

• Use only accounts, items and organisations you've created yourself.
• If you come across someone else's data, stop, don't keep or share it, and tell us straight away.
• Do only what's needed to demonstrate the issue. Don't exfiltrate data, create persistent access or pivot to other systems.
• Don't use the Finder API to enumerate or bulk-check the registry.
• Respect our rate limits and don't attempt to brute-force PINs, codes or passwords.
• Keep the details confidential until we've fixed the issue, or for 90 days from your report, whichever is sooner, unless we agree otherwise.

4. How to report

Email security@regimate.app with:

• a description of the issue and its potential impact;
• the steps to reproduce it, including URLs, requests and any proof of concept;
• the accounts or identifiers you used;
• how you'd like to be credited, if at all.

Our security contact details are also published at /.well-known/security.txt.

5. What you can expect from us

• We'll acknowledge your report within three working days.
• We'll confirm whether we can reproduce the issue and keep you updated while we fix it.
• We'll let you know when it's fixed and, with your permission, thank you publicly.
• We don't run a paid bug bounty at the moment, but we appreciate every valid report.

6. Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorised. We won't take legal action against you or ask the police to investigate, including under the Computer Misuse Act 1990, and we'll make that clear if anyone else takes action over research that followed this policy. This doesn't cover activity that breaks the law in other ways or harms our users.