Responsible disclosure

Report a vulnerability

Email security@rigaway.com with a description, affected component and version, reproduction steps, and the impact you observed. We'll acknowledge your report within 3 business days, keep you updated while we investigate and fix it, and let you know when it's resolved. We're happy to credit you publicly if you'd like. We don't currently run a paid bug bounty.

Please do

• Give us a reasonable time to fix an issue before public disclosure — we ask for 90 days, and we'll coordinate the timing with you.
• Only test against your own account, your own devices, and your own data.
• Stop and tell us right away if you encounter anyone else's data; don't keep, use, or share it.
• Avoid privacy violations, data destruction, and service disruption.

Please don't

• Access or modify other users' data, run denial-of-service or load tests, or send spam.
• Use social engineering, phishing, or physical attacks against us, our users, or our providers.
• Test our third-party providers' own systems (for example Cloudflare, Apple, or Google) — report issues in their services to them.

Safe harbor

If you make a good-faith effort to follow this policy, we'll consider your research authorized, we won't pursue or support legal action against you for it, and if a third party takes legal action over research you did under this policy, we'll make it known that you acted with our authorization.

Scope

In scope: the Rigaway iOS and Android apps, the desktop agent, our APIs (api.rigaway.com), our website (rigaway.com), and the hosting platform itself (for example, access controls on private websites on rigaway.app). Out of scope: the content of user-published websites on rigaway.app and custom domains, which are controlled by their owners — report abusive user websites via Report abuse instead.

Machine-readable contact: /.well-known/security.txt. Last updated October 18, 2026.