Email [email protected]. We reply within 3 working days and tell you what we think within 10 working days.
What to send
Which app or game and its version, the device and operating system you saw it on (for example iOS, macOS or Windows), what you found, and how to reproduce it. If it is too sensitive to put in an email, say so first and we will find another way to take it.
What we do
We confirm we have it, tell you whether we could reproduce it and how serious we think it is, then fix it and let you know when the update is out. We will credit you when it ships unless you would rather we did not. There is no paid bounty — we would rather promise a fast, honest reply we can actually deliver.
We ask you to give us a chance to fix the problem before you publish it, to test only against your own device and your own data, and not to disrupt anything. If you do that, we will treat your research as authorised and we will not pursue you for it.
What is not ours to fix
Bugs in the platforms we ship on belong to their makers: iOS, macOS and Apple's services go to Apple Product Security, Steam and its client go to Valve, and Windows goes to Microsoft. We are also not the right people for scanner output with no demonstrated impact, or for findings that only work on a jailbroken or otherwise modified device.
How updates reach you
Security fixes ship as ordinary updates through the store you got our software from, free, to everyone on a supported version: the App Store for our apps, Steam for our games. With automatic updates on (Settings → App Store on iPhone; Steam updates games by default), you get them without doing anything. We will never ask you to install our software from anywhere else.
Our apps and games keep your data on your device rather than on our servers, so uninstalling removes what they stored. Each one's privacy policy says exactly what it holds.
Contact
[email protected] · also published in
security.txt
Stationify Oy, Helsinki, Finland · Y-tunnus
3608699-3