Reporting a security problem

If you have found a vulnerability in the Churr app, in the API at api.churr.io, or in this website, please tell us.

Email [email protected]. Include enough for us to reproduce it. If it is sensitive, say so in the first line and we will send you a way to share it privately.

There is no bug bounty

We would rather say that plainly than imply a payment we cannot make. Churr is two people. We have no budget for rewards and we are not going to pretend otherwise so that a report arrives and then disappoints someone.

What we do offer, and will hold ourselves to:

• An acknowledgement within two working days, from a person, not an autoresponder.
• An assessment within five working days — whether we agree it is a vulnerability, how serious we think it is, and what we intend to do.
• Credit in the release notes when the fix ships, under whatever name you choose, or none at all if you prefer.
• We will tell you when it is fixed.

If this changes — if there is ever a bounty — it will be on this page before it is anywhere else.

We will not come after you

If you act in good faith under this policy, we will not pursue legal action against you, and we will not report you to your employer, your university or the police. That holds even if you break something by accident, as long as you tell us.

Good faith means: you stopped as soon as you understood the problem, you did not take more data than you needed to demonstrate it, you did not use what you found, and you gave us a chance to fix it before telling anyone else.

In scope

• The Churr iOS app.
• api.churr.io — the API the app talks to.
• churr.io — this website.
• Anything that lets one person reach another person's data: their phone number, their messages with their twin, their location, their plans.

Out of scope, and what we ask you not to do

These are the things that hurt other people rather than finding a problem:

• Do not test against other people's accounts. Use your own. Churr introduces real people to each other; an account you are probing may belong to someone waiting to meet a stranger on a Saturday.
• No denial of service, no load testing, no brute force. If you think a rate limit is too loose, tell us the number rather than demonstrating it.
• No social engineering of us, of our vendors, or of anyone using Churr.
• No physical testing of anything.
• Do not access, modify or delete data that is not yours. If a bug gives you access to somebody else's, stop there — that is already the finding.

We are also, in advance, not interested in reports that consist only of a scanner's output: a missing header on an endpoint no browser loads, a TLS configuration rated A− instead of A, or a version number in a response. If you think one of those is actually exploitable here, show us how and we will read it carefully.

Things we already know

Saying these out loud saves everybody's time:

• Phone numbers are the only identity check. Churr verifies that somebody controls a phone number and that they said they are 18 or over. It does not verify who they are. That is a product decision, described on Meeting someone safely, not a vulnerability.
• A published Nest card is public on purpose. Pages under /n/ are pages a person chose to publish. They are never indexed and never cached, and they contain what that person chose to put on them.
• The API sends no CORS headers in production. It serves a native app and no browser origin is allowed. If a scanner reports a missing Access-Control-Allow-Origin, that is the intended configuration.

How we handle what you send us

Your report goes to two people and no further. If it involves somebody else's personal information, we record the incident in our internal register — Quebec's Law 25 requires one — and we assess whether the people affected have to be told. If they do, we tell them, and we tell the Office of the Privacy Commissioner of Canada where PIPEDA requires it. That happens whether or not the report came from you, and it is not something you need to do on our behalf.

We will not share your name or your email with anyone outside those two people without asking you first.

Machine-readable version: /.well-known/security.txt (RFC 9116).