Trust & safety

Peshsaf Security Policy

Last updated: October 19, 2026

What to include

• The affected app version, URL, API endpoint, or feature.
• Clear reproduction steps and the security impact.
• Logs, screenshots, or a proof of concept that does not contain another person's private data.
• A safe way to contact you for follow-up.

Good-faith testing

Use only accounts and data you own or have explicit permission to test. Avoid denial of service, automated traffic that degrades availability, social engineering, physical attacks, spam, credential stuffing, destructive actions, or accessing, changing, retaining, or sharing another person's data. Stop and report immediately if you encounter personal data or gain unintended access.

In scope

The Peshsaf Android and iOS applications, peshsaf.noorbit.dev, the public Peshsaf API used by the applications, and the Peshsaf Telegram bots are in scope. Vulnerabilities in third-party providers should be reported to those providers unless Peshsaf's configuration is the cause.

Out of scope

Reports limited to missing security headers without demonstrated impact, version disclosure, self-XSS, UI/UX suggestions, rate-limit observations that do not enable abuse, and vulnerabilities that require a rooted or jailbroken device without any Peshsaf-specific weakness are generally not security issues.

Our response

We aim to acknowledge a complete report within five business days, assess severity, keep the reporter informed when practical, and publish a fix or mitigation based on risk. Peshsaf does not currently operate a paid bug-bounty program and cannot promise compensation.

Protecting users

Peshsaf uses HTTPS for network traffic, stores service credentials outside the mobile app, restricts administrative tools, and supports deletion of optional accounts. No system is perfectly secure; keeping the app and operating system updated remains important.