Reporting a security problem

Cuppi holds information about people's homes and families, so we take its security seriously. If you think you have found a vulnerability, we want to hear about it, and we will work with you to fix it.

How to report

Email support@cuppi.co.uk with “Security report” in the subject. Please include:

• what you found, and where (app screen, web page, or API)
• the steps to reproduce it
• what you think someone could do with it
• how you would like to be credited, if at all

Please do not report security problems through app reviews, social media or public forums.

What we promise

• We will acknowledge your report within 5 working days.
• We will keep you updated while we investigate and fix it.
• We will tell you when it is fixed, and credit you if you want us to.
• If you follow this policy in good faith, we will not take legal action against you or report you to the authorities for your research.

The rules

• Only test with accounts and households you own. Never access, change or delete anyone else's data. If you come across other people's data by accident, stop, do not keep it, and tell us.
• No denial-of-service, spam, or automated scanning at volume.
• No social engineering or phishing of Cuppi users or staff, and no physical attacks.
• Give us a reasonable time to fix the problem before you tell anyone else. We aim to fix serious issues within 90 days, and will agree a disclosure date with you.

In scope

• The Cuppi app for iPhone and iPad
• cuppi.co.uk
• The services the app uses to store and share household data

Out of scope: problems that need a jailbroken or physically compromised device, reports from automated tools without a working example, missing best-practice settings with no demonstrated impact, and third-party services we use (please report those to the provider).

Rewards

Cuppi is a small, independent app and we do not run a paid bug bounty. We are genuinely grateful for every report, and with your permission we will thank you publicly.