Report a security issue

If you think you have found a security problem in the Pour Score app, this website, or the service the app connects to, please tell us. Pour Score is run by one person, who reads every report.

How to report

Email support@pourscoreapp.com with the word "Security" in the subject line. Please include:

• what you found and where (the app screen, the web address, or the part of the service)
• the steps to repeat it
• the app version and your device, if it is about the app
• any proof you have, such as a screenshot or a short description

Please do not include other people's personal data in your report. If you came across any while testing, stop there and tell us what kind it was, not what it said.

What to expect

• We aim to reply within 5 working days to say we have your report.
• We will tell you whether we agree it is a problem, and keep you updated while we fix it.
• We fix serious problems first.
• If you would like credit when we publish a fix, tell us how you want to be named. We do not run a paid bounty programme.

What is covered

• The Pour Score iPhone app
• pourscoreapp.com
• The Pour Score service the app uses to store accounts, pours and photos

What is not covered

• Attacks that only slow the service down or flood it with traffic
• Spam, phishing or tricking people (social engineering), including against us
• Physical attacks on devices or premises
• Results from automated scanners with no real impact shown
• Problems in other companies' services, such as Apple, Google or our hosting providers. Please report those to them

Testing in good faith

We welcome research on the parts listed under "What is covered". If you follow the rules below, we will treat your research as authorised and will not take legal action against you for it.

• Use only your own accounts and data.
• Do not access, change or keep more data than you need to show the problem. If you come across other people's personal data, stop and tell us.
• Do not slow down or disrupt the service.
• Do not use social engineering, phishing or physical attacks.
• Do not ask for payment, or threaten to share or publish what you found.

This page speaks only for Pour Score. We cannot give permission on behalf of Apple, Google, our hosting providers or anyone else, and it does not excuse anything else that breaks the law. If you are unsure whether something is allowed, ask us first, using the address above.

Personal data

If a problem puts personal data at risk, we will follow the law: we tell the Information Commissioner's Office within 72 hours of becoming aware where it is required, and we tell the people affected where there is a high risk to them.

Telling others

Please give us a reasonable time to fix a problem before you share the details publicly. We will tell you when it is fixed.

Our security.txt file is at pourscoreapp.com/.well-known/security.txt.