Security Disclosure

We welcome reports from security researchers. This page explains how to report a vulnerability in WheresNow and what to expect from us.

How to report

Email [email protected] with the subject line Security report, and include:

• a description of the issue and its impact
• the steps to reproduce it
• the affected app version, URL or API endpoint

Please don't include other people's personal data in your report.

Scope

• The WheresNow iOS, Android and Apple Watch apps
• wheresnow.net
• WheresNow APIs used by the apps

Out of scope: denial-of-service or load testing, social engineering or phishing of our staff or users, physical attacks, spam, automated scanner output with no demonstrated impact, and issues in third-party services we don't control (report those to the provider).

Rules

• Only test against your own accounts, or accounts whose owners have agreed.
• Never access, change or keep another person's data, especially location data. If you reach it by accident, stop and tell us.
• Give us reasonable time to fix the issue before you disclose it publicly.

What to expect

We aim to acknowledge reports within 3 business days, to tell you whether we've confirmed the issue, and to keep you informed while we fix it. With your permission, we're happy to credit you once it's fixed.

Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorized. We won't take legal action against you or ask law enforcement to investigate you for it, and if a third party takes action against you over research that followed this policy, we'll make that clear. This doesn't apply to anything that breaks the rules above, such as accessing other people's data, disrupting the service, or demanding payment for not disclosing an issue. If you're unsure whether something is allowed, ask us first.

We don't currently run a paid bug bounty.