Security

If you find a vulnerability in Zoopace, please tell us privately first. We appreciate it, and we'll work with you to fix it.

How to report

Email security@zoopace.com with:

• what you found and where (the URL or API endpoint),
• the steps to reproduce it,
• what someone could do with it.

We aim to reply within three working days and to keep you updated until it's fixed. With your permission, we'll thank you by name once it is.

In scope

• zoopace.com and api.zoopace.com
• the Zoopace apps, once released

Please don't

• access, change or delete data that isn't yours: use your own accounts and sites to test,
• run denial-of-service tests, spam, or social engineering against us or our users,
• report issues in services we use (Google, Facebook, Amazon Web Services, MapTiler, GBIF) to us: report them to those services.

Good faith

If you follow these guidelines, we won't take legal action against you for your research, and we'll treat your report as authorised.

Machine-readable: /.well-known/security.txt