Report a vulnerability
If you’ve found a security problem in the Luney app, this website or our API, please tell us. For some people on Luney, privacy is what keeps them safe, so a hole here could put a real person at risk.
Where to send it
- [email protected]
- Subject line
- Security
- Machine-readable
/.well-known/security.txt
What to include
- What you found.
- Where it is: the URL, the API endpoint, or the screen in the app.
- How to make it happen again, step by step. A proof of concept helps, and a video is fine too.
- Whether you’d like credit once it’s fixed, and if so, the name to use.
What we promise
- Someone on our team reads every report.
- We reply as soon as we can, usually within a few days, and tell you how the fix is going.
- We won’t take legal action against good-faith research that follows the ground rules below.
- If your report leads to a fix, we’ll thank you publicly once the fix is out, if you’d like us to.
Ground rules
- Don’t open, change or delete data that isn’t yours. Use test accounts wherever you can.
- If you come across someone else’s data, stop there. Write down what happened and put it in your report, instead of looking any further.
- Don’t run denial-of-service tests, send spam, or try to trick our team or our users into anything (social engineering).
- Give us a fair amount of time to fix the problem before you talk about it in public.
What’s in scope
The Luney apps for iPhone and Android, this website (luneyapp.com), luney.lgbt (where links shared from the app open), and our API at api.luneyapp.com.
Services other companies run for us, like the app stores, payment processors and email providers, are out of scope. Please report problems with those to the company that runs them.