Vulnerability disclosure

Who this covers

INT6 Ltd, a company registered in Scotland, number SC547705, trading as INT6, which builds and holds InMyWords. It covers app.inmywords.chat and inmywords.chat. It is reviewed once a year.

How to report

1. Email us. Write to [email protected] with "Security" in the subject, or use the contact form.
2. Say what you found. The address, what you did, what happened, and anything we need to see it ourselves.
3. One report is enough. You do not need to have proved every consequence.

What we ask

1. Do no harm. Do not read, change or delete anybody else's data beyond the least needed to show the flaw, and stop as soon as you reach any.
2. Do not disrupt the service. No denial of service, no automated scanning at volume, no social engineering of our staff or customers.
3. Give us time. Keep the details to yourself until we have fixed it, or until 90 days have passed, whichever is sooner.

What we do

1. We reply. We acknowledge a report within five working days.
2. We fix it. We tell you what we found and when it is fixed.
3. We credit you. If you would like to be named when it is fixed, we will name you.

For software

The same details are published at /.well-known/security.txt.