Security

Reporting security issues

How to report

Write to support@ryvion.de with “Security report” in the subject. Helpful details: a description of where the issue occurs, what steps trigger it, what becomes possible, and — if available — screenshots or log excerpts.

For automated tools, the same contact is published at /.well-known/security.txt.

What we commit to

• We confirm receipt of your report.
• We assess it and tell you how we rate it.
• We keep you updated until the matter is resolved.
• If you wish, we credit you as the finder once it is fixed.

What we do not commit to: fixed response deadlines and monetary rewards. Ryvion is developed by a single person; there is no bug bounty programme. We would rather promise nothing than fail to deliver.

What we ask of you

• Give us time to fix the issue before publishing details.
• Do not access other people’s accounts or data. If you inadvertently see personal data, stop and tell us.
• Do not modify or delete data.
• No denial-of-service attacks, no mass mailing, no social engineering against individuals.
• Comply with applicable law.

Reports that stay within this scope we regard as a contribution to the security of our users — not as an attack.

What is in scope — and what is not

In scope are the Ryvion iOS app and the website ryvion.de including all its subpages.

Out of scope are third-party services we use but do not operate — such as the App Store or our hosting provider. Such findings are best reported directly to the provider concerned. Also not relevant are reports consisting solely of an automated scan report without demonstrating an actual impact.

Data protection incidents

If your finding involves personal data, please say so clearly. We treat such reports with priority, because statutory deadlines apply to them. General information on data protection is set out in the website privacy policy and the app privacy policy.

Last updated: 15.08.2026