Security
How to report a vulnerability, and our promise to people who do.
Report a problem
Email support@recalldb.app with "Security report" in the subject. Say what you found, the address or request involved, and the steps to repeat it. Please do not include real people's data. We will reply within 5 working days, tell you when it is fixed, and credit you if you want. The same details are in security.txt.
In scope
- recalldb.app and its API (/v1), the signup and "Manage my key" forms, and the docs.
- checkrecalls.org, the consumer site built on RecallDB.
- Problems such as injection, cross-site scripting, broken access to another person's key or data, key or email leaks, ways around the limits or the human check, and exposed secrets.
Out of scope
- Denial-of-service or load testing, and spam or social engineering of anyone.
- Findings that need a stolen device or already-leaked key, and missing best-practice headers with no real impact.
- Reports from automated scanners with no demonstrated impact.
- Agency websites and other third parties (report those to them).
Please
- Test only on accounts you own. Do not read, change or delete other people's data, and stop if you reach it.
- Do not run tests that slow the service down for others.
- Give us a reasonable time to fix a problem before you tell others.
Our promise
If you act in good faith and follow this policy, we will not take legal action against you or ask anyone else to, and we will work with you to understand and fix the problem. There is no cash reward program, but we will say thank you.