Responsible Disclosure Policy

1. Reporting

Email hello@mailtoucan.com with a clear description, steps to reproduce, the affected URL or component and any proof-of-concept. Please give us reasonable time to fix the issue before sharing it publicly.

2. Please do

• Make a good-faith effort to avoid privacy violations, data destruction and service disruption.
• Only interact with accounts you own or have explicit permission to test.
• Stop and report immediately if you access another person’s data.

3. Please don’t

• Run denial-of-service, spam or social-engineering attacks against our staff or customers.
• Access, modify or exfiltrate data that is not yours.
• Use automated scanners that generate heavy traffic.

4. Safe harbour

If you act in good faith and follow this policy we will not pursue legal action against you for your research.

5. What happens next

We aim to acknowledge reports within 3 business days, keep you updated, and credit researchers who wish to be named. We do not currently run a paid bounty program.