Reporting a security issue

1. Contact

Email security@turnanalog.com. This address is monitored and is our single point of contact for security matters.

2. What to include

What you found, where, and how to reproduce it. If you have a proof of concept, include it. Tell us if you believe it is already being exploited, because that changes what we are legally required to do and how fast.

3. What we will do

We will acknowledge your report within 3 working days and tell you our assessment within 10 working days. If we are fixing it, we will tell you roughly when. If we are not, we will tell you why.

4. Disclosure

We ask that you give us 90 days before publishing. If a fix is ready sooner we will say so and you are free to publish then. If we are going to miss 90 days we will tell you before day 90 rather than after, and agree a new date with you. We will not ask for indefinite silence.

5. Credit

We will credit you in the advisory unless you ask us not to.

6. What we ask

So that a report does not harm the people we are both trying to protect:

• –Do not access, modify, or delete data belonging to other people
• –Do not degrade the service for others
• –Do not run automated scans that amount to a denial of service
• –If you access personal data accidentally, stop, tell us, and delete it

7. Our commitment

If you follow this policy in good faith, we will not pursue legal action against you, and we will say so publicly if anyone suggests otherwise.

8. Scope

The Analog iOS app and its extensions, api.turnanalog.com, and turnanalog.com. Out of scope: our third-party providers (Apple, Supabase, Railway, AWS). Report those to them directly, though we would like to know too if it affects Analog users.

9. No bounty

We do not currently pay for reports. We would rather say that plainly than have you find out after doing the work.