Security
Report a security problem
Kitty Board holds families' plans and children's accounts, so we take security reports seriously. If you think you've found a problem, please tell us privately first.
How to tell us
Email [email protected] with the subject Security. Please include:
- what you found and where (the page, screen or address);
- the steps to show it, and what you expected to happen instead;
- whether you saw anyone else's information (please don't keep or share it).
What we promise
- We reply within 3 working days to say we've got your report.
- We keep you updated at least every 10 working days until it's fixed.
- We tell you when it's fixed and, if you'd like, thank you by name.
- We won't take legal action against you for research that follows the rules below.
We don't run a paid bug bounty yet.
The rules for testing
- Only use accounts you created yourself. Never try to reach another person's or another family's information.
- If you do see someone else's information by accident, stop, don't keep it, and tell us.
- No denial of service, load testing, spam or automated scanning that floods the service.
- No social engineering of our team or our users, and no physical attacks.
- Give us a reasonable time to fix a problem before you talk about it publicly.
What's included
The Kitty Board app at app.kittyboard.app, the iPhone and Android apps, and this website. Problems in the services we use (such as Supabase, Cloudflare, Stripe or RevenueCat) should go to them, though we'd like to hear about anything that affects Kitty Board.
Machine-readable contact details are in security.txt. See also our privacy policy.