Vulnerability Disclosure Policy

Last updated: July 10, 2026

1. Our commitment

STYL stores people's private closet photos, so security is not optional for us — it is the product. We welcome and value good-faith security research on styl.fit and the STYL apps and backend. If you believe you have found a vulnerability, we want to hear from you, we will treat your report seriously, and we will work with you to understand and fix the issue.

2. How to report a vulnerability

Email support@styl.fit with:

• a description of the issue and where you found it (URL, app screen, API endpoint, or component);
• step-by-step instructions to reproduce it — the single most useful thing you can include;
• your assessment of the impact (what an attacker could do with it); and
• any proof-of-concept material, screenshots, or logs that help us confirm it.

Please report in English if you can (see Preferred-Languages in our security.txt). We will:

• acknowledge your report within 5 business days, and
• aim to triage it — confirm, assess severity, and tell you our plan — within 14 days of acknowledgment.

We ask that you give us a reasonable opportunity to investigate and fix the issue before any public disclosure, and that you keep the details of the vulnerability confidential until it is resolved. We are happy to keep you updated on our progress along the way.

3. Safe harbor

We will not pursue or support legal action against you for security research conducted in good faith and in accordance with this policy. Research conducted this way is considered authorized, and we will not report it to law enforcement or pursue claims under anti-hacking or anti-circumvention laws for it. In return, good-faith research means you:

• do not access other users' data beyond the minimum needed to prove the issue — one record or one screenshot demonstrating access is proof enough; do not browse, download, copy, alter, or delete data that isn't yours;
• stop and report immediately if you encounter personal data (someone else's photos, email address, or profile) — do not keep, share, or further examine it, and delete anything you unintentionally retained once we confirm receipt of your report;
• do not degrade the service — no denial-of-service or resource-exhaustion testing, no spam, no automated high-volume scanning that impairs the service for real users;
• do not use social engineering, phishing, or physical attacks against STYL, its infrastructure providers, or its users; and
• test only against accounts you own or accounts whose owners have explicitly agreed to participate.

If you are ever unsure whether something is in bounds, email us first at support@styl.fit and ask — we would much rather answer a question than have you guess.

4. Scope

In scope

• styl.fit — this website and everything served under the styl.fit domain;
• the STYL iOS app and the STYL macOS app; and
• the STYL backend — our Supabase-hosted database, authentication, storage, and edge functions, as reachable through the apps and their APIs.

Out of scope

• Third-party services and infrastructure themselves — vulnerabilities in Apple, Supabase, Google, or Anthropic platforms belong in those vendors' own disclosure programs. (A misconfiguration by STYL of such a service — for example, a permissive access rule we set — is in scope.)
• Clickjacking on pages with no sensitive actions (e.g., framing a static marketing page).
• Rate-limiting reports without demonstrated impact — "there is no rate limit on X" is out of scope unless you can show a concrete consequence.

5. Rewards and recognition

STYL does not operate a bug bounty program at this time, and we cannot offer monetary rewards. We do, however, gladly credit reporters who want recognition — tell us in your report if and how you'd like to be credited (name, handle, or link), and we will acknowledge your contribution when the fix ships. If you prefer to stay anonymous, we will honor that too.

6. Questions

Anything unclear about this policy, or a report that doesn't fit the mold? Email support@styl.fit.