Security Policy
Public vulnerability disclosure policy · Last updated: 22 Sep 2026
Reporting a vulnerability
Pulln handles personal data under GDPR, including data about minors. We take security reports seriously and commit to a fast, transparent process.
Do not open a public GitHub issue for security reports.
Email: security@pulln.io
Machine-readable reporting: /.well-known/security.txt (RFC 9116).
OpenPGP encryption for reports is not published yet. When a real key is ready it will be listed as Encryption: in security.txt.
Please include:
- A clear description of the issue and its impact.
- Steps to reproduce (proof-of-concept where possible).
- The affected URL, endpoint, or commit SHA.
- Your name or handle if you would like public credit.
Do not include production PII (guest names, emails, phone numbers) in your report. Use anonymised or test data where possible.
Response SLA
| Stage | Target |
|---|---|
| Acknowledgement of report | within 48 hours |
| Triage and severity assignment | within 5 business days |
| Coordinated public disclosure | within 90 days of the initial report |
We aim to patch critical issues faster than the disclosure window and will coordinate timing with the reporter.
Scope
In scope
- Authentication and session handling (Supabase Auth, magic links, JWT)
- GDPR data exposure (PII leaks, retention-policy bypass, DSAR failures)
- Cross-Site Scripting (XSS) — reflected, stored, DOM-based
- Cross-Site Request Forgery (CSRF) on Server Actions and API routes
- SQL Injection or any injection into Supabase / Postgres
- Row-Level Security (RLS) bypass — reading or writing data owned by another user
- Server-Side Request Forgery (SSRF)
- Privilege escalation (member → admin, child → adult without guardian consent)
- Account takeover via email, invitation link, or DSAR token abuse
- Sub-processor secret or token exposure
Out of scope
- Denial-of-service tests against production. Use staging.
- Social engineering of Pulln staff or partners.
- Attacks requiring physical access to a user's device.
- Automated scanner output without a working proof-of-concept.
- Vulnerabilities in third-party services already reported upstream.
Safe harbour
Good-faith security research conducted within this policy is authorised and will not be the basis of legal action. Please give us reasonable time to fix an issue before any public disclosure.