Security and vulnerability reporting

Version 8 · Last updated 16 October 2026

This page is our policy on coordinated vulnerability disclosure. It names the address for security reports, says what we ask of you, and says what you can expect from us.

1. How to report a vulnerability

Send your report to privacy@relocat.org and write “security” at the start of the subject line.

That address is our single point of contact for security reports, and you can use it to reach us directly and quickly. Where the Cyber Resilience Act applies to us, it is also the contact address for reporting vulnerabilities in our product. (Art. 13(17) and Annex I Part II points 5 and 6 of Regulation (EU) 2024/2847)

We publish a security.txt file under the /.well-known/ path on relocat.org. It names this page and the address above. (RFC 9116)

One person operates Relocat. There is no security team, and there is no paid bug bounty.

2. What to put in your report

  • The affected component and version: the Android app, the server API, the website, or the guest page.
  • What an attacker can do with the flaw, and what that costs a user.
  • The steps to reproduce it, with the smallest example that shows the problem.
  • Whether you accessed, changed, kept or shared any data that is not your own.
  • How you want to be credited if we publish a note about the fix.

3. What we ask of you

  • Test against your own account and your own data only.
  • Do not read, copy, change or delete other people’s data.
  • Do not run denial of service tests, and do not send bulk or spam traffic.
  • Do not use social engineering against our users, our providers or the operator.
  • Give us a reasonable time to fix the problem before you publish it.
  • Tell us at once if you have seen data belonging to someone else, and delete your copy.

4. What we do in return

  • We confirm that your report reached us.
  • We give you our first assessment as soon as we can.
  • We tell you what we found and when we expect a fix.
  • We credit you in the release note for the fix, unless you ask us not to.

Relocat is run by one person, so a substantive answer can take days rather than hours. We do not pay for reports.

Where a flaw has exposed personal data, we follow the breach process described in our Privacy Policy.

5. Safe harbour

We treat security research that follows this page as authorised, and we welcome it.

We will not bring a civil claim against you, and we will not ask for your prosecution, for research that stays inside Sections 2 and 3.

We cannot bind anyone else. Public prosecutors act on their own authority, and we have no power to waive their decisions or those of our providers.

If you are unsure whether a test is covered, ask us at privacy@relocat.org before you run it.

6. Reporting to authorities

Where the Cyber Resilience Act applies to us, we report an actively exploited vulnerability in our product to the coordinating CSIRT and to ENISA on the statutory schedule: an early warning within 24 hours of becoming aware of it, a vulnerability notification within 72 hours, and a final report no later than 14 days after a fix is available. (Art. 14(1) and 14(2) of Regulation (EU) 2024/2847)

The same route carries reports of a severe incident affecting the security of the product: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of that notification. (Art. 14(4) of Regulation (EU) 2024/2847)

Those reporting duties apply from 11 September 2026. The rest of that Regulation applies from 11 December 2027. (Art. 71(2) of Regulation (EU) 2024/2847)

7. Source code

The app is free software under the GNU General Public License version 3 or later. Reading its source code is the fastest way to check a suspicion before you report it. The Source page says where the code is published; until the public repository exists, write to privacy@relocat.org for a copy. The server’s source code is not published. You do not need it to check what the server can see: your device encrypts your content before upload, and that happens in the app’s code.

8. Version

Version 8 (October 2026): Section 7 rewritten. The app is free software under the GNU General Public License version 3 or later, and reading its source code is the fastest way to check a suspicion before you report it; the server’s source code is not published. The link now points to the Source page at /source/. No change to the disclosure policy, the contact address, the safe harbour or the reporting schedule.

Version 7 (September 2026): first publication of this page. It sets out the coordinated vulnerability disclosure policy, the single point of contact for security reports, the safe harbour for research, and the reporting schedule we follow towards the authorities.