Hacker policies

blindmate started as a hobby project and is now a community effort with the honest intention to make the dating world more social (no marketing bullshit). As we are a small team, we welcome any support that helps us to keep our systems safe and our users’ privacy uncompromised.

Rewards

We’re not generating revenue as of today. This means that at the moment we cannot pay monetary rewards. In order to value the contribution of external security researchers, we offer to

give credit to a name or nick name inside the app (in the right tab we may add a subsection to “The blindmate crowd”)
give credit to a name or nick name on our web page
once blindmate offers a premium membership, you or a person of your choice is eligible for life-long membership
or if you’re in Berlin: a drink on us :)

(depending on your choice).

Rules

We welcome anything that helps to make our servers safe and maintain our users’ privacy. Of course this means that you may not compromise our user’s privacy or disclose security vulnerabilities without mutual agreement.
Please report any security vulnerabilities to team@blindmate.de. We will respond within a few days and will do our best to fix issues within two weeks.

Scope

All services listed below are considered as belonging to the core services of blindmate:

IP addresses in scope

```
185.216.176.219 / 2a03:4000:4f:b91::/64
```
```
185.216.177.133 / 2a03:4000:4f:b79::/64
```
```
202.61.224.34	 / 2a03:4000:56:b7d::/64
```
```
202.61.228.82	 / 2a03:4000:57:e61::/64
```
```
202.61.224.46	 / 2a03:4000:56:b3d::/64
```

Domains in scope

```
blindmate.de
```
```
invited.blindmate.app
```
```
sync.blindmate.de
```
```
appiphany.eu
```
```
location.blindmate.de
```
```
static.blindmate.de
```
```
survey.blindmate.de
```

Apps in scope

```
eu.appiphany.blindmate
```
on iOS AppStore
```
eu.appiphany.blindmate
```
on Google Play Store

Exclusions

The following issues are outside the scope of our program:

Attacks requiring physical access to a user's device
Missing security headers which do not lead directly to a vulnerability
Vulnerabilities affecting users of outdated browsers or platforms
Social engineering of blindmate employees or contractors
Any access to data where the targeted user needs to be operating a rooted mobile device
Searching for Denial of Service (DoS) attacks is acceptable as long as the security researcher uses modest resources (e.g. shows that it is possible to cause major server load with a single consumer machine and typical bandwidth). Distributed Denial of Service (DDos) attacks are not acceptable
Account takeover by gaining access to another person’s phone number