Vulnerability disclosure policy

Email info@adskitty.com with:

• what you found and where (the URL or feature),
• the steps to reproduce it, and
• what an attacker could do with it.

Please keep it between us until it's fixed, and give us up to 90 days to fix it before you share it publicly.

• Confirm we got your report within 3 business days.
• Tell you whether we can reproduce it, and how and when we plan to fix it.
• Let you know when it's fixed, and credit you if you'd like.

• Test only with accounts and Apple Ads accounts you own. AdsKitty is in closed beta; email us if you need a test account.
• Don't look at, change or delete anyone else's data. If you come across some, stop, and tell us what you saw.
• No denial of service, spam, social engineering, phishing or physical attacks, and no automated scanning heavy enough to slow the service down.
• Never connect, change or spend from an Apple Ads account that isn't yours.

If you make a good-faith effort to follow this policy, we consider your research authorized. We won't take legal action against you or report you to the authorities for it, and if someone else does, we'll make it known that you acted within this policy.

In scope: adskitty.com and auth.adskitty.com, including the web app.

Out of scope: the services we use, such as Apple, Google, RevenueCat and Resend (please report to them), and findings with no real security impact on their own, such as missing best-practice headers, clickjacking on pages without sensitive actions, self-XSS, or reports from automated tools without a working proof.

We don't run a paid bug bounty at the moment, but we're grateful for every report, and happy to thank you publicly.