Security & responsible disclosure

We hold people’s money and personal details, so we take security reports seriously and gratefully.

Reporting a vulnerability

Email security@snowsorted.com with enough detail to reproduce the issue. We acknowledge every report within 72 hours and keep you updated until it’s resolved.

Machine-readable details live at /.well-known/security.txt.

What we ask

• Give us a reasonable chance to fix the issue before disclosing it publicly.
• Don’t access, modify or retain data that isn’t yours.
• No social engineering, physical attacks, or denial of service.

What you can expect

• Acknowledgement within 72 hours, from a monitored mailbox.
• No legal action for good-faith research within the rules above.
• Credit for the find if you’d like it, once fixed.