Vulnerability Disclosure Policy

Rizora.io LLC

We welcome reports from security researchers and anyone who finds a security problem in Rizora. Because Rizora holds information about minors, we ask you to take extra care, and we'll work with you in good faith.

How to report

Email security@rizora.io with:

• a description of the vulnerability and its potential impact,
• the steps to reproduce it (URLs, requests, screenshots, or a short video),
• the account type you used (athlete, parent, staff, trainer, and so on), and
• how you'd like to be credited, if at all.

Please don't include real user data in your report beyond what's needed to show the issue.

What to expect

1. We'll confirm we received your report within 3 business days.
2. We'll investigate and tell you whether we've confirmed the issue, usually within 10 business days. If we can't reproduce it, we may ask for more detail; if we still can't, we'll close the report and tell you why.
3. We'll fix confirmed issues as quickly as their severity warrants and keep you updated along the way.
4. With your permission, we'll credit you once the fix is live.

We don't currently offer paid bounties.

Scope

In scope:

• rizora.io and its subdomains, including dev.rizora.io
• the Rizora iOS and Android apps
• Rizora's server functions and APIs

Especially interested in: any way to see or change another user's information, bypass consent or guardian controls, see an athlete who hasn't shared with you, identify an anonymous college athlete, access trainer or program data across accounts, act as a verified staff member without verification, bypass payments, or make the AI assistant read or change data it shouldn't.

Out of scope:

• third-party services we use (such as Stripe, Supabase, Vercel, or Apple and Google). Report those to the provider.
• social engineering or phishing of Rizora staff or users
• physical attacks
• denial-of-service or volume testing
• automated scanner output without a demonstrated impact
• missing best-practice headers or settings with no demonstrated security impact

Rules of engagement

• Use only accounts you own or that we've created for you. Never access, change, or delete another person's information. If you encounter someone else's data, stop, don't keep it, and tell us.
• Never interact with minors' accounts or data. If you need a test athlete account, email us and we'll set one up.
• Don't degrade the Services for others, and don't use automated tools at volumes that could cause harm.
• Give us a reasonable time to fix an issue before you share details publicly, and coordinate disclosure timing with us.
• Don't demand payment in exchange for not disclosing an issue.

Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized, we won't pursue legal action against you for it, and if a third party takes action against you over research done under this policy, we'll make it known that your work was authorized. If you're unsure whether something is allowed, ask us at security@rizora.io before you do it.