Security at Shipcue
How to report a vulnerability, and what you can expect from us.
Draft. This policy may still change before Shipcue is released. Last updated: .
Reporting a vulnerability
Email security@shipcue.app. Please include:
- what you found and where (app version, endpoint or screen),
- steps to reproduce,
- the impact you expect.
Never send API keys (.p8 files), tokens or other secrets, even your own. Redact them from screenshots and logs.
What we promise
- We reply within 5 working days.
- We keep you updated while we fix the issue and tell you when it is fixed.
- We credit you when we announce the fix, if you want.
- We will not take legal action against good-faith research that follows this policy.
Please
- Only test with your own accounts, keys and apps.
- Do not access, change or delete other people’s data. If you reach it by accident, stop and tell us.
- Do not run denial-of-service tests, spam, or social engineering against us or our users.
- Give us reasonable time to fix the issue before you publish it (we suggest 90 days).
In scope
- The Shipcue iPhone and iPad app
- Our server endpoints under shipcue.app
Apple’s services (App Store Connect, APNs) and RevenueCat are out of scope; report issues with them to those companies.
Phishing
Shipcue never asks for an API key, password or login in a notification, and our notifications never contain outside links. If you get one that does, please forward it to security@shipcue.app.