Legal & compliance
Security Disclosure Policy
Please report suspected JoinTheSwing security vulnerabilities privately and promptly so we can protect members before details are published.
Effective: August 16, 2026
1. Reporting
Email [email protected] with a clear reproduction steps, affected URLs or app versions, and a non-destructive proof of concept where useful. Our machine-readable contact details are published at /.well-known/security.txt.
2. Safe-research expectations
Do not access, alter, copy, screenshot, retain, or redistribute member data, private messages, intimate media, identity material, credentials, tokens, object paths, or provider data. Use a disposable test account, stop at the minimum evidence needed, avoid denial-of-service or social-engineering tests, do not attack third parties or accounts you do not control, and preserve confidentiality for 90 days after resolution or until we agree publication is safe.
3. Handling
We triage reports promptly, prioritize member-safety and privacy impact, restrict unsafe surfaces when needed, and update reporters at material milestones. When coordinated disclosure is appropriate, we ask for an opportunity to deploy protection before public technical detail is released.