PENDING LEGAL REVIEW — this text has not been approved by a lawyer. Highlighted parts are not decided yet.
Reporting a Security Vulnerability
If you found a security vulnerability in Koruya, tell us: account@koruya.app. Machine-readable contact details: https://koruya.app/.well-known/security.txt
1. Scope
- The Koruya mobile app (Android), the koruya.app site, the app.koruya.app web app, status.koruya.app, maps.koruya.app and content.koruya.app.
- Out of scope: the third-party services themselves (Supabase, Cloudflare, Google, etc.); social engineering and physical attacks; load tests that disrupt the service (DoS).
2. How to report
- Write the vulnerability, how to reproduce it and its impact to account@koruya.app. You can write in Turkish or English.
- Do not access, change or delete real users' data; use your own test accounts. If you come across personal data, stop there, do not keep it and tell us.
- Do not trigger a real SOS, call, SMS or disaster alert.
- Do not publish the vulnerability before giving us a reasonable time to fix it [coordinated disclosure period, e.g. 90 days — decision].
3. What you can expect from us
- We confirm that we received your report and share how the fix is going [response time — decision].
- We do not intend to take legal action over research done in good faith and within these rules [safe harbour wording — legal confirmation].
- We have no paid bounty programme today; if you wish, we credit you on a thanks list after the fix.
4. Personal data breaches
If we learn of a personal data breach, we notify the competent authority and the people affected within the period the law sets (under KVKK, the Board within 72 hours at the latest) [breach response plan — owner].