Privacy is the whole point of theSHFT, so we want to hear about any weakness you find. If you think you have found a security problem in the app, the website or our servers, please tell us privately first. We will work with you to fix it.

1. HOW TO REPORT

Email support@theshft.app with the subject "Security report". Please include:

• What you found and why it matters.
• The steps to see it happen again, with the app version and device, or the web address.
• Any proof of concept, screenshots or logs, with other people's information removed.
• How you would like to be credited, or that you would rather stay unnamed.

2. WHAT IS COVERED

• theSHFT for iPhone and iPad, and theSHFT for Android.
• The web app at app.theshft.app and the website at theshft.app.
• Our servers and the services the apps talk to that we run.
• Our public encryption code at github.com/wma1101/theshft-crypto.

3. WHAT IS NOT COVERED

• Tricking, phishing or pressuring our team or our users.
• Attacks that need physical access to someone else's phone.
• Flooding, load testing or anything that slows the service for others.
• Spam, or reports from automated scanners with no shown impact.
• Problems in services run by others, such as Apple, Google or our calling provider. Please report those to them.

4. THE RULES WHILE TESTING

• Only use accounts you own or have permission to use.
• Never look at, change, keep or delete anyone else's messages, media or account information.
• If you reach another person's information by accident, stop, do not keep it, and tell us right away.
• Give us a fair chance to fix the problem before you share it publicly. We ask for 90 days, and we will keep you updated.

5. WHAT WE PROMISE

• We reply within 3 business days to confirm we have your report.
• We keep you updated while we work on a fix and tell you when it is done.
• We credit you on this page if you want, once the fix is out.
• If you follow this policy in good faith, we will not take legal action against you for your research, and we will treat it as authorized.

We do not offer paid rewards at this time.

6. THANK YOU

Researchers who helped make theSHFT safer will be listed here.