Vulnerability Disclosure

Reporting a security issue

‍

If you believe you have found a security problem in HearthBook, we want to hear about it, and we will treat you as a partner, not a suspect. This page says what is in scope, how to reach us, what we will do, and what we ask of you.

‍

In scope

• app.hearthbook.com and everything under it, including the API
• www.hearthbook.com
• Email HearthBook sends (sign-in, invitations, notifications)

‍

Out of scope

• Third-party services we use (Supabase, DigitalOcean, Cloudflare, Stripe, Twilio, Resend, Anthropic, Webflow, Microsoft 365). Report those to the provider.
• Denial-of-service, volume testing, or anything that degrades the service for other people
• Social engineering of HearthBook staff, customers, or emergency contacts; physical attacks
• Findings that require a compromised device, account, or browser extension
• Missing best-practice headers, version banners, and similar reports without a demonstrated impact

‍

How to report

‍

Email security@hearthbook.com. Tell us what you found, where, and how to reproduce it. Screenshots help. Do not send us other people’s data — if you reach something you should not be able to see, stop, note the point you reached, and report it. Create your own test accounts for anything that needs an account.

‍

What we will do

• Acknowledge your report within 3 business days.
• Tell you our assessment and a fix plan within 10 business days.
• Keep you informed as we fix it, and tell you when it is resolved.
• Credit you by name here if you want that, once the fix is live. We do not currently run a paid bounty program.

‍

What we ask of you

‍

If you follow this policy, HearthBook considers your research authorized. We will not pursue or support legal action against you for good-faith testing that follows these rules, and we will say so to anyone who asks:

• Test only against accounts you created. Never access, change, or delete data belonging to anyone else.
• Stop as soon as you have enough to demonstrate the problem.
• Do not run automated scanners at volume, and do not test anything in the out-of-scope list.
• Give us a reasonable time to fix the issue before you talk about it publicly. We will work with you on timing.
• Keep anything you did see confidential, and delete it once the report is closed.

‍

Thank you. HearthBook holds information people would not want lost or exposed, and the people who look for problems in good faith help us keep it that way.

‍

Our machine-readable contact file: app.hearthbook.com/.well-known/security.txt