Terms of Service

If you have found a security problem in Dreamala, we would genuinely like to hear about it. This page tells you where to send it, what happens next, and what we can and cannot offer in return.

You do not need permission to look. Reading this page is permission enough, within the boundaries below.

Email support@dreamala.com with the subject line starting "Security". Please include enough for us to reproduce the problem — a request, a sequence of steps, or a short script is ideal.

We will acknowledge your report within three working days, and tell you what we think within ten. If we disagree that something is a vulnerability, we will say why rather than going quiet.

The Dreamala apps for iOS and Android, this website, and the API behind them.

We are most interested in anything that lets one person reach another person's dreams, photographs or account; anything that grants a paid feature without paying; and anything that lets a single account consume resources without limit.

Reports produced only by an automated scanner, with nothing showing real impact.

Findings that need a stolen device that is already unlocked, a rooted or jailbroken phone, or software the person has installed to attack themselves.

Missing hardening headers, or a rating from an external service, where you cannot show what an attacker would actually do with it.

Social engineering of our team, our users, or our suppliers; and anything involving physical access to our offices or hardware.

Denial of service by volume. Please do not send us floods of traffic to prove a point — describe the mechanism instead and we will take it seriously.

Use your own account and your own data. If you reach somebody else's, stop, and tell us what you saw rather than how much of it there was.

Give us a reasonable chance to fix the problem before you tell anybody else. We will not ask you to stay quiet indefinitely, and we are happy for you to publish once it is fixed.

Do not change or delete anything that is not yours, and do not run anything that would degrade the service for other people.

We will not take legal action against you for research carried out in good faith and within this page, and we will treat your report as authorised access for the purposes of computer misuse law.

We will credit you by name in the fix, if you want that, and tell you when it ships.

We do not run a bug bounty and we do not pay for reports. Dreamala is a very small operation, and we would rather say this plainly here than have the question arrive alongside a finding. If you are looking for payment, please do not spend your time on us — and please do not withhold a report in the hope of changing this answer, because it will not change.

None of that makes your report less welcome. We would rather know.