Report a security concern

How to reach us

Email hello@reskoo.app with the details. There is also a security.txt file at the usual place if you use automated tools.

What to include

The more you can tell us, the faster we can act. Where you can, please include:

• what you found, and why you think it is a problem;
• the web address or page where you saw it;
• the steps to reproduce it, and anything you needed to set it up;
• a screenshot or short recording, if that helps explain it.

Reskoo holds real people's details, including children's. Please do not access, change, download or keep anyone else's data while looking into a problem, and only ever use test accounts you have set up yourself. Report what you find and stop there.

What you can expect from us

• We will acknowledge your report, usually within a few working days.
• We will look into it, keep you updated on what we find, and let you know when it is fixed.
• We will not take legal action against you for a report made in good faith that follows this page, and we are happy to credit you once a fix is out, if you would like that.

We do not run a paid reward scheme, so there is no bounty for reports. We are simply grateful for the help.

Please do not

• run tests that could take the service down for clubs, such as denial-of-service or heavy automated scanning;
• use another person's account, or their real data, without their permission;
• publish the details before we have had a fair chance to fix the problem.