Security & Vulnerability Disclosure

Reporting a vulnerability

If you believe you have found a security vulnerability in MatrimonyTrust, please tell us privately before telling anyone else. Email support@matrimonytrust.com with [SECURITY] at the start of the subject line.

Please include:

• What the vulnerability is
• The steps to reproduce it
• Which part of the service it affects
• What an attacker could do with it
• A suggested fix, if you have one

We read every report that reaches this address and we will reply to you. We would rather give you an honest answer than a service-level promise we cannot keep — we are a small team, and a report about a real risk is treated as urgent.

In scope

• matrimonytrust.com — the web application
• api.matrimonytrust.com — our API
• The sign-in flow, including phone verification and session handling

MatrimonyTrust is a web service. There is no mobile app, so there is nothing to test on iOS or Android.

Out of scope

• Services we build on rather than operate — reports about them belong with their own security teams
• Social engineering of our team, our members, or our suppliers
• Physical attacks on people or premises
• Denial-of-service and volumetric testing — please do not attempt it
• Findings from an automated scanner with no demonstrated impact

What we ask of you

• Do not access, change, or keep any other member's data. If you reach data that is not yours, stop and tell us what you found — you do not need to prove it by taking more.
• Test only against your own account. This is a matrimony service: the data in it is among the most personal anyone will ever put online.
• Give us 90 days to fix an issue before publishing it. If we are being slow, say so — we would rather agree a date than miss one.

Safe harbour

If you follow this policy and act in good faith, we will not pursue legal action against you, and we will not report you. We regard your research as authorised. If you are unsure whether something is allowed, ask us first — a question is always welcome.

Security reports are for vulnerabilities. To report a member — harassment, a fake profile, a scam — use the report option on their profile or contact us; a report about someone's behaviour is not a security report and will be slower to reach the right person here.