Responsible Disclosure Program
For security researchers who've found a vulnerability in Share The Aloha.
Share The Aloha is committed to ensuring the security of our service and our users' information. We encourage security researchers to contact us to report any potential weaknesses identified in our product, system, or any asset belonging to Share The Aloha.
This program is not a public bug-bounty program. We make no offers of reward or compensation for submitting potential issues. We genuinely appreciate your commitment to improving the security of our service and we will acknowledge your contribution publicly (with your permission) where appropriate.
Guidelines
Security researchers will disclose potential weaknesses in compliance with the following guidelines.
Please DO
- ✓Share the security issue with us privately before disclosing it publicly (e.g., on message boards, mailing lists, blogs, or social media).
- ✓Wait until we have confirmed the vulnerability has been resolved before disclosing it to third parties. Some vulnerabilities take longer to address than others.
- ✓Provide a clear, concise description of the steps needed to reproduce the vulnerability.
- ✓Provide proof-of-concept URLs, screenshots, or relevant logs, along with the details of the system(s) where tests were conducted.
- ✓Use only your own test accounts created specifically for security research. Do not interact with other users' accounts or data.
Please DON'T
- ✗Cause harm to Share The Aloha, our users, partners, infrastructure providers, or employees.
- ✗Engage in any act that may cause an outage or interrupt our service.
- ✗Engage in illegal activities or any acts that violate international, federal, state, or local laws or regulations.
- ✗Store, share, compromise, or destroy any data belonging to Share The Aloha or our users while conducting research. If you encounter personally identifiable information (PII), stop and notify us immediately.
- ✗Conduct social-engineering attempts against our staff, partners, or users.
- ✗Conduct denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks of any form.
- ✗Perform physical-security testing of any of our offices, facilities, or those of our infrastructure providers.
- ✗Conduct fraudulent activity or complete fraudulent financial transactions (real or test) as part of your research.
Out-of-scope issues
The following are explicitly outside the scope of this program. We may decline to investigate reports limited to these categories.
- ·Phishing or other social-engineering attacks against our users or staff.
- ·Physical-security testing of our offices or our providers' facilities.
- ·Denial-of-service (DoS) attacks of any form, including volumetric, application-layer, or protocol-based.
- ·Vulnerabilities affecting only outdated browsers or operating systems.
- ·Self-XSS or attacks requiring full social-engineering of a victim.
- ·Missing security headers without a demonstrated impact.
- ·Reports based on automated scanner output without manual verification.
How to submit a report
Send your report to security@sharethealoha.com.
Please include:
- →A clear summary of the vulnerability.
- →The URL or feature affected.
- →Step-by-step instructions to reproduce.
- →Screenshots, proof-of-concept code, or logs as applicable.
- →Your contact information so we can follow up.
We aim to acknowledge receipt within 5 business days and to provide an initial assessment within 14 business days. For high-severity issues we will respond as quickly as we can.
Safe harbor
We will not pursue legal action against security researchers who:
- ✓Make a good-faith effort to comply with the guidelines on this page.
- ✓Report vulnerabilities promptly and only to us before any public disclosure.
- ✓Refrain from privacy violations, destruction of data, and interruption or degradation of our service during research.
- ✓Avoid violating any other applicable law or regulation.
Share The Aloha reserves its legal rights in the event of non-compliance with these guidelines. If in doubt about whether a planned test crosses a line, contact us first at security@sharethealoha.com and we'll work with you.
Recognition
With your permission, we'll acknowledge researchers who responsibly disclose verified vulnerabilities on a thank-you page once we've built it. We will never publish your information without your consent.
If you have a different concern
- →Abusive content or harassment: report@sharethealoha.com
- →Privacy-rights requests (access, deletion, correction): support@sharethealoha.com
- →Account or billing issues: support@sharethealoha.com
- →Copyright takedown (DMCA): dmca@sharethealoha.com
Last updated: May 30, 2026. We will update this page as the program evolves.