Security & responsible disclosure

How plugwith.me is secured, how to report a vulnerability, and what we promise in return. The detailed control list is Annex II to the Data Processing Agreement.

1. Report a vulnerability

Please include: what you found, where, the steps to reproduce it, what an attacker could achieve, and any proof-of-concept. Screenshots and a short video help. Tell us if you intend to publish, and when.

What we commit to

• Acknowledgement within 3 business days that a human has read your report.
• An initial assessment within 10 business days, telling you whether we consider it valid and how severe we rate it.
• Progress updates at least every 14 days while we work on a fix.
• A target of 30 days to remediate a critical or high-severity issue, 90 days for the rest. Where we cannot meet that we will tell you why.
• Credit in the acknowledgements below, if you want it. We do not currently pay bounties — we are a one-person operation — but we will say so up front rather than let you assume otherwise.
• We will not pursue legal action against you for research conducted in accordance with section 2, and we will make that position clear if a third party raises it.

2. Safe harbour and rules of engagement

Testing within these rules is authorised, and we will treat it as such:

• Test only against accounts and links you control. Create a free account for the purpose.
• Do not access, modify, retain or exfiltrate data belonging to anyone else. If you encounter someone else's data, stop, do not save it, and tell us what you saw so we can assess the exposure.
• No denial of service, no load or stress testing, no spam, no social engineering of us or of our providers, and no physical attacks.
• Do not test our subprocessors' own infrastructure — Netlify, Supabase and Stripe each run their own programmes; report to them directly.
• Give us a reasonable opportunity to fix the issue before disclosing it publicly. 90 days from your report is a reasonable default; we will usually be faster and are happy to coordinate.
• Do not use a finding to gain an advantage, and do not demand payment in exchange for withholding disclosure. That is extortion, not research, and we will treat it accordingly.

Research that stays inside these rules is authorised access for the purposes of § 202a StGB and comparable computer-misuse provisions. Step outside them and this authorisation does not apply.

3. In scope

• plugwith.me and all paths under it, including /app, /admin and /admin/api;
• the link pages at plugwith.me/<slug>;
• our edge functions, our CSP and security headers, and our authentication and session handling;
• tenant isolation — anything that lets one account read or write another's data is our highest-severity class;
• the FanFlow integration endpoints under /admin/api/fanflow/*.

Out of scope

• Findings that require a compromised device, a rooted phone or a malicious browser extension.
• Missing security headers with no demonstrated impact, and reports produced solely by an automated scanner.
• Rate-limit thresholds, unless you can show a practical amplification or bypass.
• Email configuration findings (SPF, DKIM, DMARC) unless you can demonstrate a working spoof.
• The content of destination URLs — that belongs in plugwith.me/report, not here.
• Self-XSS, clickjacking on pages with no state-changing action, and vulnerabilities in third-party services.

4. How the Service is secured

A summary; the full control list is Annex II to the DPA.

5. If something goes wrong

Our incident procedure is: detect, contain, assess within 24 hours, notify affected controllers within 48 hours, notify the supervisory authority within 72 hours where Article 33 GDPR requires it, notify affected individuals without undue delay where the risk is high, remediate, and record. Where we act as processor for a customer, we notify that customer rather than the authority, so that they can meet their own deadline — see section 7 of the DPA.

We will not stay quiet about an incident that affects you in order to avoid embarrassment.

6. Acknowledgements

Researchers who have reported valid issues and asked to be named will be listed here. The list is currently empty — be the first.

7. Regulatory note

plugwith.me is operated by a micro-enterprise and is not an essential or important entity within the meaning of Directive (EU) 2022/2555 (NIS2), so the registration and reporting duties of that Directive do not apply to us. Our obligations under Article 32 GDPR apply in full and are met as described above. Should our size or classification change, we will update this section.