Skip to content
Get the appParent sign-in

Security

Vulnerability disclosure policy

We welcome reports from security researchers and curious users. If you think you have found a weakness, tell us privately, give us time to fix it, and we will work with you.

Last updated: October 22, 2026EnglishTürkçeDeutschFrançaisEspañolItalianoPortuguês (Brasil)日本語

  1. 1In scope

    • This website, earbunny.app, and its subdomains that we operate.
    • The parent web dashboard.
    • Our API, as used by the apps and the web dashboard.
    • The iOS app, including the Apple Watch app and widgets.

  2. 2Out of scope

    • Denial-of-service attacks, load or stress testing.
    • Social engineering or phishing of our team, our users or our providers.
    • Physical attacks on offices, data centres or devices.
    • Spam, or sending many messages through the contact form or sign-up.
    • Services run by third parties (for example the App Store, Cloudflare, Vercel or Sentry). Please report those to the provider.
    • Reports from automated scanners without a demonstrated, exploitable impact.

  3. 3Rules of engagement

    • Use test accounts you created yourself. If you need a second family to test access rules, create a second test family.
    • Don't access, change or delete other people's data. If you reach someone else's data by accident, stop, take only what proves the issue, and tell us.
    • No destructive testing: don't degrade our services, delete data or plant persistent changes.
    • Keep the details confidential until we have fixed the issue and agreed with you on disclosure.
    • Act in good faith and within the law.

  4. 4How to report

    Write to . Please include:

    • What you found and where (URL, endpoint or app screen, app version).
    • Step-by-step instructions to reproduce it, with screenshots or a short video if helpful.
    • The impact you believe it has.
    • How we can reach you, and whether you would like to be thanked by name.

    Encrypted email (PGP) isn't available yet. Please don't send other people's personal data; if you need to share something sensitive, describe it and we will agree on a safe way to exchange it.

  5. 5Our commitments

    • We acknowledge your report within 3 business days.
    • We triage it and tell you our assessment within 10 business days.
    • We keep you updated until the issue is fixed, and tell you when it is.
    • We credit you, if you wish, once the fix is out.
    Safe harbour. If you follow this policy in good faith, we will not take legal action against you or ask the authorities to do so for your research. If a third party takes action against you over research that followed this policy, we will make clear that you acted with our authorization.

  6. 6Rewards

    We don't run a paid bug bounty yet. We are a small team, and we would rather say so than promise something we can't keep. With your permission, we list researchers who helped us in a hall of thanks on this page.

  7. 7security.txt

    Our contact details and this policy are also published in machine-readable form at /.well-known/security.txt. For an overview of how we protect data, see Security.