Responsibledisclosure

If you think you have found a security issue in Unifesto, email security@unifesto.app with:

• what the issue is and where (URL, endpoint, app screen and version);
• steps to reproduce it, and a proof of concept if you have one;
• the impact you think it has;
• how to reach you, and whether you would like to be credited.

• unifesto.app and its subdomains, including space.unifesto.app and the Unifesto API;
• the Unifesto app for iOS and Android.

• Services we use but do not run (Razorpay, AWS, Google, Apple, Meta, OneSignal and others). Report those to the provider.
• Denial of service, load or spam testing, and social engineering or phishing of our team or users.
• Physical attacks on offices or event venues.
• Missing best-practice headers, clickjacking on pages with no sensitive action, self-XSS, or rate limits without demonstrated impact.
• Reports from automated scanners without a working proof of concept.

• Use only accounts you own or have permission to use. Do not access, change or delete other people’s data; if you reach any, stop, and include only what is needed to show the issue.
• Do not make real payments or refunds to test, or disrupt live events.
• Give us reasonable time to fix the issue before telling anyone else, and do not share it publicly until we confirm it is fixed.

• We acknowledge your report within 3 working days and keep you updated until it is fixed.
• If you follow this policy in good faith, we will not take legal action against you for your research, and we will treat it as authorised.
• With your permission, we credit you once the issue is fixed.

We do not run a paid bug bounty at this time. We are grateful for every valid report and say so publicly if you would like.