Security & responsible disclosure
Last updated: October 27, 2026
Our commitment
Profilapp protects professionals' and clients' data with encryption in transit, database row-level security on every table, two-step verification, sign-in alerts, rate limits and a strict content security policy. We welcome reports from security researchers.
How to report a vulnerability
Email support@profilapp.com with the subject "Security". Include the affected page or endpoint, the steps to reproduce it and the impact. Please don't include other people's personal data. We reply within 3 business days and keep you informed until it's fixed.
Safe harbour
If you act in good faith and follow this policy, we will not take legal action against you or ask anyone else to. Thank you for helping keep Profilapp safe.
Please don't
Access, change or delete other users' data beyond what's needed to prove the issue; run denial-of-service, spam or brute-force tests; social-engineer our team or users; test physical security; or publish the issue before we've fixed it (we aim for 90 days at most).
In scope
www.profilapp.com and its API routes. Out of scope: third-party services we rely on (Supabase, Vercel, PayPal, Meta, Cloudflare, Resend), which have their own programmes, and reports from automated scanners without a demonstrated impact.
Recognition
We don't run a paid bug bounty yet. With your permission, we'll credit you here for valid reports.