Security

Spontio is a privately run project. If you find a security vulnerability in Spontio, please tell us. We fix it as quickly as we can and work with you on when it is published.

How to report

Write to security@spontio.app. Describe what you found, how to reproduce it and what an attacker could do with it. German or English is fine.

What we promise

We confirm your report within 3 working days. We aim to fix a vulnerability within 90 days, and at once if it is already being exploited. We keep you informed along the way. We agree with you when and how the vulnerability is published, and on request we thank you by name on this page.

If you test and report in good faith and follow the rules below, we will take no legal action against you.

Rules for testing

Only use your own accounts and test data. Do not access, change or delete other people's data; if you come across it by accident, stop and tell us. Do not put load on the servers (no denial of service, no mass requests). No social engineering, no phishing, no physical attacks. Do not publish details before we have agreed on it.

What this covers

The website spontio.app, the web app web.spontio.app with its sign-in pages and interface (API), and the Spontio apps for iOS and Android. Services of other providers, such as PayPal or our e-mail provider, are not covered; please report to them directly.

Good to know

There is no reward programme (bug bounty). Questions that are not about security go to info@spontio.app.