Security and Vulnerability Disclosure

Email support@rapidnative.com with "Security" in the subject line. Please include:

• The affected URL or API endpoint
• Step-by-step instructions to reproduce the issue
• What an attacker could do with it (the impact)
• A proof of concept, such as a request, script or short video

A report with these details lets us confirm and fix the issue quickly. A report that only says a vulnerability exists, without describing it, cannot be acted on.

In scope:

• rapidnative.com and www.rapidnative.com, including the editor and dashboard
• The RapidNative API

Out of scope:

• Apps built by our users, and the preview hosts that serve them (*.rapidnative.app). Report issues in a user's app to that app's owner. Issues in the preview platform itself are in scope.
• Third-party services we use, such as Supabase, Stripe and Vercel. Report those to the vendor.
• LetsDeployIt (letsdeploy.it), which publishes its own policy.

The following are not treated as vulnerabilities unless you can show a concrete, exploitable impact:

• Missing or misconfigured HTTP security headers
• SPF, DKIM or DMARC configuration
• Clickjacking on pages with no sensitive actions
• Self-XSS, or CSRF on logout and other non-sensitive actions
• Software version or banner disclosure
• Rate limiting on endpoints that are not authentication or payment related
• Output from automated scanners without a working proof of concept
• Issues that require physical access to, or a compromised, victim device

We will not pursue legal action against research carried out in good faith under this policy. In return, we ask that you:

• Only access, modify or keep other users' data to the extent needed to prove the issue, and stop as soon as you have
• Test against your own account and projects wherever possible
• Do not run denial-of-service attacks or degrade the service for other users
• Do not use social engineering, phishing or spam against our team or users
• Give us reasonable time to fix the issue before disclosing it publicly. We ask for 90 days from your report, and will coordinate a disclosure date with you.