01
How to report
Email [email protected] with “Security report” in the subject. Include:
- what the problem is and where (the URL, endpoint or feature);
- the steps to reproduce it, with requests and responses if you have them;
- what an attacker could do with it.
We reply within two working days, confirm whether we can reproduce it, and keep you posted until it is fixed. Please give us 90 days to fix it before you share it publicly; we will usually be much faster.
02
In scope
- reelspan.com, the marketing site and docs
- app.reelspan.com, the dashboard, connect, approval and report pages
- api.reelspan.com, the REST API and the MCP server
- The official SDKs (Node and Python)
03
Out of scope
- The social networks themselves, Lemon Squeezy, Cloudflare and our other providers: report to them.
- Denial of service, load testing, spam, and anything that degrades the service for others.
- Social engineering of our team or customers, and physical attacks.
- Missing headers or settings with no practical attack (for example clickjacking on a page with no actions), self-XSS, and reports from automated scanners without a working proof.
- Rate limits being reachable, email spoofing of domains we don’t send from, and issues only in outdated browsers.
04
Rules for testing
- Use only accounts you created. Use a test API key (rs_test_…) so nothing is posted to real networks.
- Never access, change or delete data that isn’t yours. If you reach someone else’s data by accident, stop, don’t keep it, and tell us.
- Don’t post to other people’s social accounts or send messages through Reelspan to people who didn’t agree to it.
- Keep request rates reasonable.
05
Safe harbour
If you follow these rules in good faith, we consider your research authorised, won’t take legal action against you, and won’t ask anyone else to. If a provider or authority asks us, we will say you acted within this policy.
06
Rewards and thanks
Every valid report is credited on this page if you want it to be. For serious problems, such as reaching another customer’s data or social accounts, taking over an account, or running code on our servers, we may also pay a reward, at our discretion, based on how severe and how well reported it is. Only the first report of a problem counts.
No reports credited yet. Be the first.