Coordinated disclosure

Report a vulnerability

Did you find a vulnerability in the website, the app or on our servers? Please report it to us confidentially using this form. You do not need to sign in.

How we handle your report

  • You get a receipt number right away. With it we can match your report at any time.
  • Only the Friendstime team sees your report. We treat it confidentially and review it.
  • If you give an email address and agree to being contacted, the team can get in touch with you with questions or after the review.
  • Please do not publish details of the vulnerability until it has been fixed, and if possible agree on the timing with us.

Please keep in mind when testing

  • Do not access other people's data and do not change or delete anyone else's data — test with your own accounts.
  • Do not disrupt the service: no load or overload tests, no spam, no automated mass requests.
  • Do not send passwords or access credentials with your report — not even your own.
  • This form is not meant for questions about your account or about other people's content — for that there is the Help page.

Your report

Affected area (Required field)
As far as you know, is the vulnerability already being exploited?
What is affected, and what can someone do with it? At least 20 characters.
Address, screen or feature, step by step — the more precise, the faster we can check. File attachments are not possible. Please describe any evidence in the text.
Only needed if we should reply to you.

What is stored: your entries from this form, the time, and a checksum of your IP address (not the address itself), which we use to slow down misuse of the form.

Prefer email?

You can also write to us directly: support@friendsti.me. Our contact details for security reports are also available in machine-readable form in the file security.txt.

Back to “Security & Privacy”