Responsible Disclosure

This program covers security vulnerabilities in:

• The Fieldza Website at https://fieldza.com
• Fieldza for iOS (Apple App Store)
• Fieldza for Android (Google Play)
• Fieldza APIs and backend services that support the above products

Out-of-scope: social engineering, physical attacks, denial-of-service attacks, spam, issues in third-party services (Stripe, Twilio, Resend), or vulnerabilities in app store infrastructure.

Email support@fieldza.com with the subject line Security Vulnerability Report. Include:

• Description of the vulnerability and potential impact
• Steps to reproduce the issue
• Affected product (Website, iOS App, Android App, or API)
• Your contact information
• Any proof-of-concept code or screenshots (if applicable)

Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate.

• Acknowledge receipt of your report within 3 business days
• Investigate and validate reported vulnerabilities promptly
• Keep you informed of our progress where appropriate
• Not pursue legal action against researchers who report vulnerabilities in good faith and comply with this policy
• Recognize researchers who report valid, previously unknown vulnerabilities (with your permission)

If you conduct security research in good faith in accordance with this policy, including making a good faith effort to avoid privacy violations, data destruction, and service disruption, Fieldza will not initiate legal action against you. We ask that you not access, modify, or delete data belonging to other users.

Learn more about our security practices on our Security page. For law enforcement requests, see our Law Enforcement policy.

All Fieldza legal policies are available on our Legal page.