Report a vulnerability

01Purpose and scope

Protecting the data of students, associations and institutions is at the heart of toGaether. If you believe you have found a vulnerability, please report it to us privately, under this policy. It covers:

• the togaether.me website and its subdomains operated by toGaether;
• the toGaether mobile apps (iOS and Android);
• the toGaether public and partner APIs.

02How to report

Write to security@togaether.me, preferably in French or English. Please do not use contact forms, social networks or public reports.

To help us verify quickly, please include where possible:

• Description: the nature of the vulnerability and the affected component (address, screen, API endpoint);
• Steps: how to reproduce it, with the relevant requests or screenshots;
• Impact: what an attacker could obtain or do, in your view;
• Contact: how to reach you for follow-up, and the date of your discovery.

Do not send third-party personal data in your report: if your demonstration revealed any, describe it without copying it.

03Our commitments

• Acknowledgement within 3 business days;
• Assessment and fix: we analyse the report, assess its severity and fix it within a timeframe proportionate to the risk;
• Updates: we keep you informed of progress and let you know when the fix is in place.

04Rules for good-faith research

During your research, we ask you to:

• use only your own accounts, or test accounts, and never act on other people's accounts or data;
• not access other people's data beyond what is strictly necessary to demonstrate the vulnerability, and stop as soon as you do;
• not modify or delete any data, and not degrade the service;
• delete any data obtained during the research once the report is made;
• not make the vulnerability public before it is fixed, or at the latest 90 days after your report, without our agreement.

05Out of scope

The following are not covered by this policy and must not be tested:

• denial-of-service attacks, load testing or any mass sending of requests;
• social engineering (phishing, calls, impersonation) targeting our team, our users or our partners;
• tests on the accounts or data of other users, associations or institutions;
• third-party services we use (payment, hosting, email, analytics): report those directly to their vendor;
• the physical security of our premises and equipment.

Research outside these rules or this scope is not covered by the commitment in section 3.

06Contact us