Report a security problem

If you have found a security problem in anything Mobixify LTD runs, please tell us. This page says how, what we ask of you and what you can expect from us. It is the policy that security.txt points to, on both mobixify.com and appstore.mobixify.com.

What is covered

• The websites mobixify.com and appstore.mobixify.com.
• The apps and games in our catalogue, and the servers and services that Mobixify LTD runs for them.

What is not covered

• Apple, Google, Amazon Web Services, RevenueCat, Expo and other companies we use. Please report problems in their services to them.
• Attacks that flood a service with traffic to knock it offline (denial of service), spam, and tests that send us large volumes of traffic.
• Tricking our people into giving access (social engineering or phishing), and physical attacks.
• Reports from automated scanners with no sign that the problem can be used against anyone, and missing security headers (extra instructions a site sends to browsers) with no shown effect.

How to report

E-mail info@mobixify.com with the subject “Security”. English or Turkish is fine. Tell us:

• what you found and where (the address or the app and its version);
• the steps to reproduce it;
• what an attacker could do with it, in your view;
• how to reach you, and whether you want to be named when we have fixed it.

Please do not put secrets or other people’s personal data in the message. If the report needs them, tell us and we can agree a safer way to send them.

What we ask of you

• Act in good faith. Test only with your own accounts and data.
• Do not access, change or keep other people’s data. If you reach personal data by accident, stop, tell us and delete what you have.
• Do not disrupt the service or its users.
• Do not ask for payment as a condition of telling us, and do not threaten to publish a problem.
• Give us a reasonable time to fix the problem before you tell anyone else. We ask for 90 days, and we may agree a different date with you.

What you can expect from us

• We usually reply within 3 to 5 working days. This is a typical time, not a promise.
• We look into the reports we receive. We may ask you for more detail, and we may tell you what we decide.
• We treat your report as confidential and do not share your name without your say, unless the law requires it.
• If we publish a note about a fix, we credit you if you want to be named.
• If you act in good faith and keep to this policy, we will not start legal action against you for research on the sites, apps and games listed above that stays within this policy. This does not bind anyone else, such as other companies, the police or the courts, and it is not permission to break the law. We may change or withdraw this policy at any time.

If the problem is about your own data

If your own data may have been exposed, or someone has used your account, also use Account and data requests. That lets us handle it as a data protection matter.

History