Reporting a security problem

Draft — internal testing. This page is a working draft that our lawyers have not reviewed yet.

If you think you've found a security problem in ScamCam, please tell us: [email protected]. You can write in English or Hebrew. Our security.txt has the same details.

What to send

• What the problem is and what someone could do with it.
• The steps to reproduce it, and the app version (Settings in the app shows it) or the web address.
• Your name or handle, if you'd like us to thank you.

Please don't include other people's personal information. If you came across some, tell us what kind it was, not the data itself.

What's in scope

• The ScamCam iPhone app, including its share extension.
• Our API at api.scamcam.net.
• Our website at scamcam.ai.

Not in scope: the services we use (Cloudflare, Apple, OpenAI, Google), which have their own reporting programmes; reports that only list missing headers or scanner output without a way to exploit them; denial-of-service or load testing; spam; and attacks on people, such as phishing our team.

Rules for testing

• Test only with your own devices and your own ScamCam installs. Use the in-app examples or your own screenshots, never other people's messages.
• Don't try to reach anyone else's checks or device records. If you do reach data that isn't yours, stop, don't keep a copy, and tell us.
• Keep your testing small: stay within the app's normal daily limits and don't run automated high-volume tools against our servers.
• Don't change or delete data that isn't yours, and don't disrupt the service for others.
• Give us time to fix the problem before you tell anyone else (see below).

What we do

• We confirm that we got your report within 5 working days, and keep you updated while we work on it.
• We ask you to wait 90 days from your report, or until we've released a fix if that's sooner, before you publish anything. If we need longer, we'll explain why and agree a date with you.
• If you'd like, we'll thank you by name when the fix is out.
• We don't have a bug bounty and can't pay for reports.

Safe harbour

If you follow the rules on this page in good faith, we won't take legal action against you for your research, and we won't ask anyone else to. If someone else takes action against you for research that followed these rules, we'll say that it was authorised.