Vulnerability Disclosure Policy

Scope

This policy covers outliyr.com, get.outliyr.com, and Outliyr apps. It applies only to systems and software Outliyr owns or operates.

Report a vulnerability

Email hello@outliyr.com with the affected URL or app version, steps to reproduce the issue, and its potential impact. Include only the evidence needed to explain the issue. Do not send passwords, access tokens, or personal or health data.

We aim to acknowledge your report within 5 business days and coordinate next steps with you. Please give us a reasonable opportunity to investigate and address the issue before public disclosure.

Good-faith research

• Use your own accounts or accounts whose owners have explicitly permitted testing.
• Limit testing to what is necessary to demonstrate the issue. Do not disrupt services, change or delete other people's data, or leave persistent access.
• If you encounter someone else's data, stop testing and report the issue. Do not download, retain, or share that data.

Safe harbor

Outliyr will not initiate legal action against you for good-faith security research that follows this policy. This commitment applies only to Outliyr; it does not authorize testing third-party systems or bind third parties.

If you are unsure whether planned testing is covered, contact us before proceeding.

Out of scope

• Denial-of-service attacks, load testing, or other activity that degrades service.
• Social engineering, phishing, or attempts to deceive staff or users.
• Physical attacks or attempts to access facilities or devices.
• Third-party services, including providers connected to Outliyr.

No paid bounty

We welcome responsible reports, but we do not offer a paid bug bounty or financial rewards.