Report a Vulnerability
We would rather hear about a security problem from you than discover it as an incident. If you have found one, this page tells you where to send it and what to expect back.
- Reports to our support address
- Good-faith research welcome
- No legal action for following this policy
How to report
Send the details to hello@smartbeautyapp.com with "Security" in the subject. Tell us what you found, the steps to reproduce it, and what an attacker could do with it. Screenshots or a short recording help. Please do not open a public issue or post it publicly before we have had a chance to fix it.
What is in scope
This site and the Smart Beauty apps, and the APIs behind them. Out of scope: reports from automated scanners with no working proof, missing best-practice headers with no demonstrated impact, denial of service, social engineering of our staff or customers, and anything that needs physical access to someone's device.
What we ask of you
Use only accounts and data that are your own. Do not access, change or keep anyone else's personal data, do not degrade the service for other people, and stop as soon as you have enough to write the report. Give us a reasonable period to fix the problem before telling anyone else.
What you can expect
We will acknowledge your report, tell you whether we could reproduce it, and let you know when it is fixed. If you follow this policy we will treat your work as authorised research in good faith and will not pursue legal action over it. We do not run a paid bounty programme.