Security and vulnerability disclosure

This policy covers:

• The iQ Signal website and app at iq-signal.io.
• The iQ Signal API that the site and app use.

It does not cover:

• Other SISUiQ products. They are run separately.
• Services we use but do not run, such as our payment provider or our hosting providers. Please report problems in those to them directly.
• Reports from automated scanners, or missing best practices, without a way to exploit them.

Email info@sisuiq.com with the subject Security. Please include:

• What you found and where (the page, URL or API endpoint).
• The steps to reproduce it.
• What an attacker could do with it.
• How we can reach you, and whether you want to be credited.

Please do not put other people's personal data in the report.

• Test only with accounts and data that are yours, or that you have permission to use.
• Access no more data than you need to show the problem, and do not keep, share or change it.
• Do not run denial-of-service tests, send spam, or scan at a volume that slows the service down for others.
• Do not use social engineering, phishing or physical attacks against us, our users or our providers.
• Give us reasonable time to fix the problem before you tell anyone else about it, and tell us before you publish.

• We will confirm that we received your report.
• We will keep you informed while we look into it and fix it.
• If you want, we will credit you by name when we announce the fix.

We do not run a paid bug bounty at the moment.

If you research in good faith and follow this policy, we will not take legal action against you and will not ask law enforcement to investigate you for that research. If you are unsure whether something is allowed, ask us first at info@sisuiq.com.

This policy is also listed in our security.txt file (RFC 9116).