Security

If you've found a security issue in UniMate, thank you. This page explains how to report it, what's in scope, and how we respond.

Reporting a vulnerability

Email security@getunimate.com with:

• A description of the issue and impact.
• Steps to reproduce.
• Any proof-of-concept code (please keep it minimal and non-destructive).
• Your name / handle if you want public credit.

We aim to acknowledge within 48 hours and triage to a severity within 5 business days. No legal action will be taken against good-faith researchers who follow the policy below.

Scope

• getunimate.com and all *.getunimate.com production domains.
• UniMate iOS / Android apps (when released).
• Public API endpoints under /api/ and api.getunimate.com.

Out of scope: third-party services (Stripe, Freedom Pay, Telegram), social-engineering, DDoS, automated scanner output without a verified exploit, missing security headers on static asset domains.

Safe harbour

• Don't access, modify, or destroy data that isn't yours.
• Don't pivot beyond the minimum needed to prove the issue.
• Don't disclose publicly until we've shipped a fix.
• Don't run brute-force, credential-stuffing, or DoS attacks.

Researchers who follow this in good faith get safe harbour from us under DMCA + analogous laws.

Recognition

We don't run a paid bounty programme yet. Significant reports get public credit on this page (with your permission) and UniMate Pro for 12 months.

Our security practices

• HTTPS-only on every production host; TLS 1.2+, HSTS preload-ready.
• Short-lived JWT (30 min) + refresh tokens, revocation on logout.
• Admin actions audit-logged: bans, refunds, exports, impersonation, role changes.
• Password hashing: argon2id (passlib).
• Web-push via VAPID; no third-party trackers.
• Postgres + Redis bound to internal docker network only; never exposed.
• Secrets via env, never in repo. Rotation on disclosure.
• Backups: daily encrypted database snapshot, 30-day retention.

security.txt

Machine-readable contact: /.well-known/security.txt.

Contact: mailto:security@getunimate.com
Expires: 2027-01-01T00:00:00Z
Encryption: https://security.getunimate.com/pgp.asc
Preferred-Languages: en, ru
Canonical: https://security.getunimate.com/.well-known/security.txt
Policy: https://security.getunimate.com/

PGP

For sensitive reports, use our PGP key (coming soon at /pgp.asc). Until then, please send a regular email and we'll respond with a signed channel.