Skip to content
All legal documents

Security & Responsible Disclosure

How to report vulnerabilities, our safe-harbor policy, and what we hold.

Version 1 · Effective June 13, 2026

Security & Responsible Disclosure

Last updated: June 2026

We take security seriously. If you've found a vulnerability in any SplitWinner product, we want to know — and we'll work with you to fix it.

Reporting

  • Email: security@splitwinner.com
  • Response time: we acknowledge reports within 72 hours
  • Coordinated disclosure window: 60 days from report by default; extension on request

Please include: a description of the issue, steps to reproduce, the affected URL or endpoint, and (if relevant) a proof-of-concept. Plain-text email is fine.

In scope

  • *.splitwinner.com (web, status, listmonk, any other public subdomain)
  • api.splitwinner.com — all /v1/* endpoints
  • SplitWinner iOS app — bundle ID com.splitwinner.splitwinner
  • Public ledger repository — github.com/SplitWinner/audit_trail

The Android build is not yet shipped and is out of scope until launch.

Out of scope

Issues in third-party services we depend on — Supabase, Vercel, Sentry, Anthropic, RevenueCat, Apple, Google, Kalshi, Listmonk, Resend, Upstash, BetterStack, Hetzner — should be reported to those vendors. We will help coordinate on serious cross-cutting issues.

Also out of scope:

  • Issues we've already disclosed in published documentation
  • Issues that depend on physical access to a user's device
  • Social-engineering attacks against staff or users
  • Denial-of-service or volumetric attacks

Rules of engagement

We ask that you:

  • Do not perform DoS or volumetric testing against production. Use the sandbox tier — request a sandbox API key from the developer portal — for at-volume testing.
  • Do not access, modify, or destroy data belonging to other users beyond the minimum needed to demonstrate the vulnerability.
  • Do not exfiltrate data. A single screenshot or minimal proof is enough.
  • Do not publicly disclose the issue before the coordinated window closes.

Safe harbor

We will not pursue legal action against good-faith security research that follows the rules above. This safe harbor:

  • Applies to research and disclosure conducted under this policy.
  • Does not authorize accessing data of other users beyond what is strictly necessary.
  • Does not waive third-party rights — including Kalshi, Anthropic, Apple, Google, and any other vendor whose terms or laws also apply.
  • May be withdrawn for malicious, repeated, or bad-faith conduct.

If you are uncertain whether a planned activity is in scope or in good faith, email us first.

What we hold (so you know what's worth testing)

We hold the minimum needed to operate the service. Worth knowing as you research:

  • B2B API keys — stored only as SHA-256 hashes. The raw key is never persisted.
  • Customer Kalshi credentials — not held. Enterprise customers connect to Kalshi from their own infrastructure with their own credentials. Our servers never see Kalshi private keys. Consumer Kalshi credentials live on the user's device in the OS keychain.
  • Predictions — append-only ledger. UPDATE and DELETE are rejected at the database trigger level. The daily ledger hash is published to github.com/SplitWinner/audit_trail and anchored to the Bitcoin blockchain via OpenTimestamps.
  • Consumer payment data — none. Apple is merchant of record; we receive only entitlement events via RevenueCat.
  • Enterprise billing — invoiced under contract; no card-on-file, no merchant processor.

Bounty

We currently run an acknowledgement-based program. There is no monetary bounty at launch. Notable disclosures may be acknowledged on this page with the researcher's consent.

Contact