Security

Reporting a vulnerability

I take the security of your data seriously. If you find a vulnerability in Piggy or any other Quiet Craft Studio app, email security@quietcraftstudio.co.

Please include

• the app name, app version and iOS version,
• a description of the issue and its potential impact,
• steps to reproduce it,
• whether you know of anyone exploiting it.

What happens next

• I acknowledge your report within 3 working days.
• I tell you my assessment and the plan for a fix.
• I ship the fix in an update and let users know if they are affected.
• With your permission, I credit you publicly.

I ask that you

• do not disclose details publicly before a fix ships or 90 days pass from your report,
• test only on your own devices and your own data,
• avoid any action that could harm other users.

I will not pursue legal action against anyone acting in good faith and in line with this policy.

Out of scope

• vulnerabilities in iOS or iCloud itself — report those to Apple via Apple Security Research,
• attacks that require physical access to an unlocked device,
• social engineering and phishing.

I do not run a paid bug bounty program.