Security & Vulnerability Reporting

1. Reporting Security Issues

We take the security and privacy of our software products and user data seriously. If you have discovered a potential security vulnerability in any of our applications (including Quote Community / One Phrase a Day) or associated backend services, please report it to us immediately at:

Email: security@pablocoding.dev
Alternative: support@pablocoding.dev

Please include:

• A description of the vulnerability and its potential impact.
• Specific product name, version, and affected endpoint or screen.
• Reproducible step-by-step instructions or proof-of-concept.
• Whether you believe the issue is being actively exploited.

2. Our Response Commitments

• Acknowledgment: Within 48 hours of receipt.
• Triage & Assessment: Within 5 business days.
• Remediation: Verified security vulnerabilities are prioritized for immediate remediation and release via app stores and backend updates.
• Coordinated Disclosure: We will collaborate with you on disclosure timelines and credit your contribution once a fix has been distributed.

3. Security Support Period (EU Cyber Resilience Act)

In accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act):

• We guarantee security updates and vulnerability handling free of charge for each major release of our applications for a minimum period of 24 months from release (through at least December 2028 for Quote Community v1.x).
• Security updates are delivered automatically via the Google Play Store and Apple App Store.

4. Safe Harbor for Ethical Researchers

We consider security research conducted in good faith to be an essential service. We will not take legal action against researchers who:

• Act in good faith to avoid privacy violations, data disruption, or destruction.
• Do not access, alter, or retain other users’ personal data.
• Give us reasonable time to resolve vulnerabilities before disclosing details publicly.