Política de divulgación de vulnerabilidades

Reporting a vulnerability

Please do not open a public issue for a suspected vulnerability. Report it privately instead, by email to security@dailyplus.app — the only reporting channel we operate.

Include, as applicable:

• A description of the vulnerability and its potential impact.
• Steps to reproduce — proof-of-concept code, request and response samples, the affected endpoint or screen.
• The app version, the platform (iOS, Android, web or API), and the account type involved.
• Whether the issue has been disclosed anywhere else.

Scope

In scope: the Daily+ mobile app, the Daily+ API, the Daily+ marketing and web app, and their production infrastructure.

Out of scope: third-party services we depend on (report those to the vendor), social-engineering and physical attacks, and denial-of-service testing against shared infrastructure. Do not run automated scanners against production without prior written permission.

What we commit to

When you report something in scope, in good faith:

• Acknowledgement within 3 business days of your report.
• Triage and a severity assessment within 7 business days, using CVSS-informed severity aligned with the high/critical dependency gate enforced in our CI.
• Critical issues patched as fast as safely possible, targeting 7 days from confirmation; high within 30 days; medium and low on the next regular release cycle.
• Coordinated disclosure: we ask for a reasonable window to remediate before public disclosure, and we credit reporters — with permission — once a fix ships.
• Safe harbour: good-faith research inside this scope that avoids privacy violations, service disruption and data destruction will not result in legal action from us.

If personal data is involved

Daily+ processes personal and health-adjacent data. A confirmed breach involving personal data of EU users is handled under our incident-response process, including the GDPR Art. 33 72-hour supervisory-authority notification where applicable, and Art. 34 notification to affected users without undue delay where the risk warrants it.

If your research incidentally exposes real user data, stop, do not retain a copy, and tell us immediately. Doing so is the safe-harbour-preserving action, not an admission of anything.

Supported versions

Only the latest released version of the mobile app and the currently deployed API and website are supported with security fixes.