Reporting a security problem

If you think you have found a security problem in Swapp (swapp.eco, api.swapp.eco or a card served there), please tell us. Email [email protected] with "Security" in the subject.

What to send

• What the problem is and where: the page, card or API address.
• The steps to see it happen.
• What someone could do with it, as far as you know.

What we promise

• We will reply to say we have your report within 5 business days.
• We will tell you what we decide to do about it, and when it is fixed.
• We will not take legal action against you, or ask anyone else to, for research done in good faith under the rules below.
• If you want credit, we will thank you by name once it is fixed. If you would rather stay anonymous, we will.

We are a small team. We do not run a paid bug bounty.

Good faith means

• Use only your own accounts, or accounts whose owners have agreed. Do not open, change or delete other people's data.
• If you reach someone else's data by accident, stop, do not keep a copy, and tell us.
• Do not slow the service down for others: no denial-of-service tests, no spam, no heavy automated scanning.
• No social engineering or phishing of our team or our players, and no physical attacks.
• Give us a reasonable time to fix the problem before you tell anyone else about it.

The machine-readable version of this contact is at /.well-known/security.txt.