Security disclosure policy

How to report

Email security@momofi.app with a clear description of the vulnerability, reproduction steps, and the impact you believe it has. If your finding involves a private credential, please redact it.

The RFC 9116 metadata file is at /.well-known/security.txt.

What's in scope

• The MoMoFi application and website at momofi.app
• Our public APIs (when published)

What's out of scope

• Denial-of-service testing or volumetric attacks
• Social engineering of MoMoFi staff or contractors
• Vulnerabilities in third-party services we depend on (Stripe, MaxMind, our hosting provider): please report those to the relevant vendor
• Findings that require physical access to a user's device

Safe harbor

If you act in good faith, accessing only data necessary to demonstrate the issue, not exfiltrating customer data, not degrading service for other users, we will not pursue legal action against you. If you're unsure whether your planned testing crosses the line, email us first and we'll talk.

What to expect from us

• Within 3 business days: acknowledgement of your report.
• Within 14 business days: initial triage decision and severity assessment.
• Within 90 days: a fix shipped or, for vulnerabilities we accept and won't immediately fix, a written rationale.

We coordinate disclosure with you. Please don't publish details before we've had a chance to ship a fix.

Recognition

We don't currently run a paid bug-bounty programme. We do publicly acknowledge researchers (with consent) when their report leads to a fix. Email us if you'd like to be listed.