Security disclosure policy
Ronski is a dating app for gay, bi and queer men. Our members trust us with sensitive information, so we want to hear about security problems and we promise to treat people who report them in good faith fairly.
How to report
- Email the address in our
security.txt: <https://ronski.app/.well-known/security.txt> (also served athttps://<api host>/.well-known/security.txt). The default contact issecurity@ronski-app.com. - Please write in English or Finnish.
- Include what you found, where, the steps to reproduce it, and what you think the impact is. Screenshots and short proof-of-concept requests are welcome.
- If you want to send sensitive details, ask in a first short email and we will agree on a channel. Do not put member data in the email.
What we promise (response times)
| Step | Target |
|---|---|
| We confirm we received your report | within 3 working days |
| First assessment and severity | within 7 days |
| Status update | at least every 14 days until it is resolved |
| Fix for a critical or high issue | as fast as we can, aiming for 30 days |
| Credit | on request, once the issue is fixed (see below) |
Ronski is run by a very small team, so these are targets, not guarantees. If we are slow, please nudge us.
Safe harbour
If you act in good faith and follow this policy we will not start or support legal action against you, and we will not ask a hosting provider or the police to act against you, for the research you describe in your report. In particular, we consider the following authorised:
- testing against your own account or accounts you created for the purpose;
- looking only as far as needed to show the problem;
- reporting to us first and giving us a reasonable time to fix before you tell anyone else.
This safe harbour covers Ronski's own systems. It cannot bind third parties (for example our hosting and infrastructure providers) and it does not let you break the law in ways unrelated to the research. If a third party starts action against you for research that followed this policy, we will say publicly that you acted with our permission.
Rules for researchers
Please do not:
- access, copy, change or keep other members' data. If you reach member data by accident, stop, do not read more, delete what you have, and tell us what happened;
- test with real members' accounts, message real members, or send spam;
- run denial-of-service, load or brute-force tests, or use social engineering or physical attacks against anyone;
- upload or view illegal content. If you come across child sexual abuse material, stop immediately and report it to the police or to Nettivihje (<https://www.nettivihje.fi>); do not tell us the details in the report and do not download or share the material.
Scope
In scope: the Ronski API and admin console on our own domains, the Ronski mobile app, and the public site ronski.app.
Out of scope: findings that only exist in third-party services (Cloudflare, Oracle Cloud, Microsoft Azure, Expo, Zoho) which should be reported to those providers; missing best-practice headers without a demonstrated impact; reports from automated scanners with no proof of impact; and vulnerabilities in outdated apps or devices.
Rewards and credit
We cannot pay bounties. We can thank you by name on a hall-of-fame list if you wish, and we will tell you when the fix is out.
Our side
We keep reports confidential, use your details only to handle the report, and tell you the outcome. If the problem put member data at risk we follow our breach procedure and notify the Data Protection Ombudsman and members as the law requires.
This page is machine-readable via security.txt (RFC 9116). The policy link in that file points here (SECURITY_POLICY_URL).