Security

If you find a security problem in the Hexpit Android app or in this website, please tell me privately.

Contact: security@hexpit.app . The same details are in security.txt.

Scope

• The Hexpit Android app (app.hexpit).
• This website, hexpit.app.

Out of scope: problems in third-party services you point the app at, social engineering, and denial of service against the site.

What to send

• What the problem is and what an attacker could do with it.
• Steps to reproduce, the app version and the device and Android version.
• Any proof of concept. Please do not include other people’s data.

What to expect

Hexpit is maintained by one developer. Reports are handled on a best-effort basis with no guaranteed response time. There is no bug bounty. If you want credit, say so and say how you would like to be named.

Good faith

If you make a good-faith effort to avoid harm, to access only your own data and to report privately, I will not take or support legal action against you for research within this scope. Please do not publish details until a fix is available or we have agreed a date.

There is no public issue tracker for security reports.