Security

How we protect your data

• All traffic between the app and our servers is encrypted with HTTPS.
• Passwords are stored as salted bcrypt hashes. Password reset codes expire after an hour.
• Login attempts and other sensitive actions are rate limited.
• Profile photos are re-encoded on upload, which strips hidden location data.
• Secrets are kept out of our code, and every change is scanned for leaked keys and vulnerable dependencies before release.
• Access to production systems is limited to the people who need it.

Report a vulnerability

If you think you have found a security problem in Boutt, please email [email protected] with:

• a description of the issue and its impact;
• steps to reproduce it (screenshots or a short video help);
• any accounts, URLs or API endpoints involved.

We will acknowledge your report within 3 working days and keep you updated until it is fixed. Please do not share the issue publicly until we have fixed it.

Scope

In scope: the Boutt mobile and web apps, our API, and this website.

Please don't:

• access, change or delete other people's data (use test accounts you own);
• run denial-of-service, spam or automated scanning that degrades the service;
• use social engineering or physical attacks against our team or users.

Our promise to researchers

If you act in good faith and follow this policy, we will not take legal action against you, we will work with you to understand and fix the issue, and, with your permission, credit you once it is resolved.