How we protect the data our apps hold, and how to tell us if you find a hole in it. Researchers acting in good faith under this policy will not be pursued.
1. How we protect data
- Encryption in transit. All traffic between the apps, our servers, our storage and every provider uses HTTPS/TLS.
- Secrets are hashed. Device secrets and recovery codes are stored only as SHA-256 hashes, never in plain text. We cannot read yours, and neither can anyone who obtains the database.
- No credentials to steal. There is no password, no email address and no phone number in our system, because there is no sign-up. A stolen record contains a random code, not an identity.
- Server-side authority. Balances, credit spending and purchase verification are decided on the server. A modified client cannot grant itself credits.
- Abuse limits. Rate limits, IP-hash-based reward limits and store receipt validation guard the free tier and the purchase flow.
- Least privilege. Production access is limited to the people who need it, over authenticated channels.
- No card data. Payments are handled entirely by Google Play and the Apple App Store. Card numbers never reach our systems.
No system is perfectly secure. We review these measures regularly and update them as the apps change.
2. Reporting a vulnerability
Email bilisamweb@gmail.com with the subject “Security report”. Please include:
- the affected app, endpoint or page, and its version;
- clear reproduction steps, with a proof of concept if you have one;
- what an attacker could achieve with it;
- how you would like to be credited, if the issue is confirmed.
We acknowledge within 5 working days, keep you updated while we investigate, and tell you when it is fixed. We ask that you give us 90 days before publishing.
3. In scope
Our published mobile apps, our API at apps.usiapps.com, and this website.
4. Out of scope
- Denial-of-service, volumetric or stress testing of any kind.
- Social engineering of our users, our staff or our providers, and physical attacks.
- Vulnerabilities in third-party services (Google, OpenAI, OpenRouter, DigitalOcean) — report those to their own programmes.
- Findings from automated scanners with no demonstrated impact, missing best-practice headers, and self-XSS.
- Anything requiring a rooted or physically compromised device already under the attacker’s control.
5. Rules for researchers
Acting in good faith means: test only against accounts you created; do not access, modify or delete another person’s data; stop as soon as you have proof of the issue; do not degrade the service for others; do not exfiltrate data; and do not publish before we have fixed it. Do this and we will not pursue legal action or ask your provider to act against you.
6. Rewards
We are a small studio and do not run a paid bug-bounty programme. We do offer public credit on this page, a genuine thank-you, and a fast fix.
7. If something goes wrong on our side
If a breach affects personal data, we assess it immediately, notify the competent supervisory authority within 72 hours where the law requires it, and inform affected users in the app and on this site where the risk to them is high. What we know, what was affected and what to do about it would be published here.