Security & responsible disclosure

We take the security of SCYN seriously, and we know that no software is free of mistakes. If you believe you have found a security vulnerability in one of our systems, we would like to hear from you.

How to report

Please e-mail security@scyn.io. We do not currently offer a PGP key; if your report contains sensitive details, say so in a first message and we will agree on a channel. Please include:

• the affected host, app or endpoint and, if possible, the URL;
• steps to reproduce the issue, or a proof of concept;
• what impact you believe the issue has;
• how we can reach you for follow-up questions.

What you can expect from us

We aim to acknowledge your report within three business days, keep you informed while we investigate and fix the issue, and tell you when it is resolved. SCYN is a small company; we do not run a bug bounty program at this time and cannot offer monetary rewards. If you wish, we will credit you once the issue is fixed.

Good-faith research

We will not pursue legal action against researchers who act in good faith: who make a reasonable effort to avoid privacy violations, data destruction and service disruption, who only access the data needed to demonstrate the issue, and who give us a reasonable time to fix it before any public disclosure.

Scope

In scope:

• scyn.io
• api.scyn.io
• the SCYN apps for iOS and Android

Out of scope:

• third-party services we rely on (for example Bunny, Hetzner, Mollie) — please report those to the respective provider;
• social engineering of SCYN staff or users;
• denial-of-service testing of any kind.