Security and vulnerability reporting

How to report

Write to olimpia@intuflow.pl with the subject “Security”. We reply in Polish and English. Please include:

• a description of the vulnerability and its possible impact,
• the address, screen or feature affected,
• steps to reproduce it (e.g. requests, screenshots),
• your contact details if you would like a reply.

olimpia@intuflow.pl

What we promise

• we will acknowledge your report within 5 business days,
• within 30 days we will share our assessment and next steps,
• we will let you know when the vulnerability has been fixed,
• we will not share your details with third parties without your consent, unless required by law.

Testing rules

• test only with your own account; do not access other people's accounts or data,
• if you come across other people's data – stop, do not keep it and report it to us right away,
• do not modify or delete data and do not disrupt the service (no DoS attacks, mass requests or spam),
• do not use social engineering against users or our team,
• do not disclose the vulnerability publicly until it is fixed or 90 days have passed since your report – unless we agree otherwise.

Good faith

If you look for and report vulnerabilities in good faith and in line with the rules above, we will not bring claims against you or file a criminal complaint in connection with your report. We do not run a paid bug bounty programme.

Scope

• the web app app.intuflow.pl and its API,
• the INTUflow Android app from Google Play (pl.intuflow.app).

Please report vulnerabilities in our providers' services (e.g. Supabase, Vercel, Google, Anthropic) directly to those providers. If you are not sure whether something is in scope – write to us.

Security updates

The Google Play app opens app.intuflow.pl in Chrome, so we deploy security fixes on the server side – they reach all users without an app update. Where the law requires it (including Regulation (EU) 2024/2847 – the Cyber Resilience Act), we report actively exploited vulnerabilities and severe incidents to the competent authorities.