Security and responsible disclosure
We care about the security of accounts and reports. If you believe you have found a vulnerability on scopemy.city or its WhatsApp channel, please tell us before discussing it publicly: we will fix it as quickly as possible.
How to contact us
Send an e-mail to contact@scopemy.city with “Security” in the subject line. If possible, include:
- the page or feature involved (URL, parameter, WhatsApp message);
- the steps to reproduce the issue;
- the impact you observed or suspect;
- how to reach you, if you wish.
Rules of engagement
- Only access other people’s data to the extent strictly needed to prove the issue, and stop as soon as you reach it.
- Do not modify, delete or keep any data that is not yours.
- No denial of service, spam, phishing, social engineering or large-scale automated scanning.
- Use your own test accounts and, for WhatsApp, your own phone number.
- Give us 90 days to fix the issue before any publication, unless agreed otherwise.
Our commitments
- We acknowledge your message within 5 working days.
- We keep you informed of our analysis and of the fix.
- We thank you publicly if you wish.
- We will not take legal action against good-faith research that follows these rules.
Scope
In scope: the scopemy.city website (and fixmy.city, which redirects to it) and the scopemy.city WhatsApp bot.
Out of scope: third-party services (Meta and WhatsApp, OpenStreetMap, the hosting provider), automated scanner reports without demonstrated impact, a missing header without an attack scenario, and attacks requiring physical access to the victim’s device.
This information is also published in the standard format at /.well-known/security.txt (RFC 9116).