Security

Email security@socivia.app. Please do not post the problem publicly or share it with anyone else until we have fixed it.

Include:

• What is affected: the web app, the API, or the mobile app.
• Steps to reproduce it.
• What you saw, or what you think an attacker could do with it.
• Any proof-of-concept code or screenshots.

We will confirm that we got your report within 3 business days. Within 7 business days we will tell you how serious we think it is and when we expect to fix it.

• socivia.app and its subdomains.
• The Socivia API at api.socivia.app.
• The Socivia apps for iOS and Android, once they are published.

• Problems in services we use. Report those to the vendor directly: Vercel, Render, Upstash, Google, Resend, Cloudflare R2, Anthropic, Mapbox, Unsplash, and Sentry.
• Denial-of-service tests, brute-force attacks, or anything that slows the service down for real people. Our rate limits on sign-in and search are deliberate.
• Social engineering of our team.
• Problems that need a compromised device or browser extension.

We will not take legal action against you if you:

• Make a good-faith effort to avoid privacy violations, data loss, and service disruption.
• Report the problem to us before you tell anyone else.
• Give us reasonable time to fix it before you publish.

We do not run a paid bug bounty. With your permission, we will credit you once the fix ships.