Security and Vulnerability Disclosure

I take the security of 9dev apps seriously. If you find a vulnerability in one of the apps or in the services they use, please report it directly to me. This page explains how to do it and what you can expect.

Single point of contact

Report vulnerabilities and security incidents to security@9dev.pl or through the report form. This is the manufacturer’s single point of contact under Regulation (EU) 2024/2847 (Cyber Resilience Act) for all 9dev apps. The address and the form are also listed in the security.txt file.

In your report, include:

• the app and its version, the platform (iOS or Android) and the operating system version,
• a description of the problem and its possible impact,
• steps to reproduce it,
• whether you know of anyone else exploiting the vulnerability.

Do not include other people’s personal data. If you need data to reproduce the problem, use your own test account.

What you can expect

• Acknowledgement of your report within 3 business days.
• An initial assessment within 10 business days.
• Progress updates at least every 30 days until a fix is released.
• An agreed disclosure date and, with your consent, credit in the security advisory.

Security fixes are free and reach users as updates in the App Store and Google Play.

Disclosure

Please do not publish details of the vulnerability for 90 days after your report or until a fix is released, whichever comes first. If the vulnerability is actively exploited or the fix needs more time, we will agree on a date together.

After a fix is released, I publish a security advisory: a description of the vulnerability, the affected app and versions, the impact, the severity and instructions for users. I may delay publication only when disclosure would create a greater risk than benefit, and only until users can install the fix.

Good-faith research

I will not take legal action against anyone who looks for vulnerabilities in good faith and follows these rules:

• test only with your own accounts and your own data,
• do not violate other users’ privacy, and do not read, change or delete other people’s data,
• do not run load (DoS) tests, spam or social engineering attacks,
• stop testing when you gain access to someone else’s data, and report it without delay,
• do not exploit the vulnerability further than needed to demonstrate it.

Scope

This policy covers the 9dev mobile apps, their backend (functions and databases in Supabase) and the 9dev.pl website.

Out of scope:

• third-party services such as Apple, Google, Supabase and RevenueCat (report these directly to their providers; if the problem is in how a 9dev app uses them, report it to me),
• physical and social engineering attacks,
• reports with no security impact, such as a missing header without an attack scenario.

There is no paid bug bounty programme.

Manufacturer obligations

I report actively exploited vulnerabilities and severe incidents to ENISA and the CSIRT designated as coordinator under Article 14 of Regulation (EU) 2024/2847. I also inform affected users about the vulnerability or incident and what they can do about it.

Other matters

• App support: support@9dev.pl.
• Privacy and account deletion: privacy@9dev.pl.
• Illegal content reports (DSA): dsa@9dev.pl.