How to report
Email compliance@snapiro.com with:
- what you found and where (URL, app screen or API endpoint)
- step-by-step instructions to reproduce it
- what an attacker could do with it
- screenshots, a short video or a proof of concept, if you have one
- how we can contact you, and whether you would like to be credited
Please do not share the issue with anyone else until we have fixed it.
What we ask of you
- Only test against your own account. Never access, change or delete other users' data or money.
- If you reach personal data by accident, stop, do not keep a copy, and tell us straight away.
- Do not run tests that could slow down or break the service for others.
- Give us reasonable time to fix the issue before you talk about it publicly.
In scope
- This website (snapiro.com) and its subdomains
- The Snapiro Android and iPhone apps
- The Snapiro API the apps use
Out of scope
- Denial of service or load testing
- Spam, social engineering or phishing of our staff or users
- Physical attacks on our offices or equipment
- Reports from automated scanners with no proof of impact
- Missing best-practice headers or settings with no security impact
What happens next
We will confirm we have your report, look into it, and keep you updated while we work on a fix. We will tell you when it is fixed and, if you want, credit you for finding it.
Not a security issue?
For problems with your own account, a deposit or a withdrawal, contact support. To report a scam using the Snapiro name, see our security page.
