Vulnerability Disclosure Policy
Last updated: · Version: 2026-10-05 · Previous versions
We welcome reports of security vulnerabilities in Rudud and thank everyone who helps us protect our users. Send your report to security@rudud.app.
Scope
- The website rudud.app and all its subdomains.
- The Rudud APIs used by the website and the iPhone app.
- The Rudud iPhone app.
Out of scope: our providers' own services (Cloudflare, Meta, Apple, Google, Resend), which you should report to them directly, and automated scanner output with no demonstrable impact.
What we ask of you
- Describe the vulnerability, the steps to reproduce it, and its expected impact.
- Test only against your own account or an account you created for testing.
- Give us reasonable time to fix it before any public disclosure.
Prohibited
- Accessing, modifying, deleting or retaining other users' data. If you reach it unintentionally, stop, tell us, and keep no copy.
- Denial of service or degrading the Service, including load testing and request flooding.
- Social engineering and phishing against our staff, users or providers.
- Physical access to any office or device.
- Sending direct messages or comments through Instagram to people who have not agreed to the test.
Safe harbor
If you research in good faith and follow this policy, we will not take legal action against you or ask anyone else to, and we consider your research authorized. If a third party brings a claim over research in which you followed this policy, we will make it known that you acted with our permission.
Response times
- Acknowledgement: within 3 business days.
- Initial assessment: we tell you whether we confirm the vulnerability and how we plan to fix it.
- Fix: we let you know when it is fixed, and credit you by name if you wish.
We do not offer monetary rewards at this time.
Contact: security@rudud.app