RichyRyanHome.com takes security seriously. This page explains how to report vulnerabilities and the scope of our security program.

Reporting a Vulnerability

If you believe you have found a security vulnerability, please report it responsibly through the platform’s in-app support channel with the subject “Security Report.” Include a clear description and, if possible, steps to reproduce. Do not publicly disclose the issue before we have had an opportunity to investigate and respond.

Scope

Vulnerabilities in the RichyRyanHome.com web application and its backend functions.
Authorization bypasses, data exposure, or injection flaws.
Issues affecting the confidentiality, integrity, or availability of user data.

Out of scope: social engineering, physical attacks, denial-of-service through volume, and issues in third-party services not operated by the platform.

Safe Harbor

We will not pursue legal action against researchers who act in good faith, avoid harm to users or data, and follow responsible disclosure. This safe-harbor statement is provided in good faith but does not constitute a legal guarantee — please consult your own counsel if you have concerns. Legal review of this statement is recommended before production deployment.

Response Expectations

Acknowledgment: within 48 hours of report.
Initial assessment: within 5 business days.
Critical fixes: prioritized and deployed as soon as a verified fix is available.
Disclosure: coordinated with the reporter after remediation.

Security Measures

Row-level security on all user-owned data, enforced at the database level.
Private object storage for documents — never public URLs for sensitive files.
Short-lived, scoped download URLs that expire within five minutes.
OAuth tokens stored server-side; never exposed to the browser.
Reset tokens are hashed, single-use, and expiring.
Generic authentication errors that do not reveal account existence.
Defense-in-depth browser policies: Content-Security-Policy, Permissions-Policy, and secure headers.