Vulnerability disclosure

Coatfire Limited takes the security of our products and the privacy of our users seriously. We welcome reports from security researchers who identify potential vulnerabilities in our systems.

This policy applies to the following Coatfire systems:

• coatfire.com and all subdomains
• Lovou application (web and mobile)
• Task Buddies application
• Any Coatfire-operated APIs

Please report security vulnerabilities by email to: security@coatfire.com

Your report should include:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any proof-of-concept code or screenshots (where applicable)
• Your contact details for follow-up

Upon receiving a report, we commit to:

• Acknowledging receipt within 48 hours
• Providing an initial assessment within 5 business days
• Keeping you informed of our progress
• Notifying you when the vulnerability has been resolved

We will not pursue legal action against researchers who discover and report vulnerabilities in good faith, provided they:

• Do not access, modify, or delete user data
• Do not disrupt our services
• Do not disclose the vulnerability publicly before we have had a reasonable opportunity to address it
• Act in accordance with this policy

The following are outside the scope of this policy:

• Social engineering attacks against Coatfire employees
• Physical security attacks
• Denial of service attacks
• Spam or phishing campaigns

Security reports: security@coatfire.com