Reporting a security problem
Last updated: October 31, 2026
If you’ve found a way into something on Woofer that you shouldn’t be able to see or change, we want to hear about it. This page covers how to tell us, what happens next, and what Woofer already does to keep members safe.
How to report
Email contact@woofersocial.com with “Security” in the subject line. Please tell us privately rather than posting about it, so members aren’t put at risk while we fix it.
Our contact details are also published in machine-readable form at /.well-known/security.txt.
This covers woofersocial.com, which is run by Woofer LLC.
What to include
- What you found, and the page, feature or address where it happens.
- Steps we can follow to see it for ourselves.
- What someone could do with it, and whose account or information it puts at risk.
- How to reach you with questions, and whether you’d like to be credited.
Leave any member information you came across out of your report unless it’s needed to show the problem, and don’t keep a copy.
What happens next
We read every report and reply as soon as we can — usually within a few business days — to let you know it arrived.
How fast we can fix a confirmed problem depends on what it is; serious ones jump the queue. We’ll keep you posted and tell you when the fix is live.
Please give us a reasonable window to fix a problem before discussing it publicly. If what you found feels too urgent for that, say so and we’ll agree on a timeline together.
Testing responsibly
- Only use accounts you own, or have the owner’s permission to use.
- Don’t view, change or delete other members’ information. If you reach some by accident, stop there and tell us.
- Don’t slow the site down, knock it offline, or send spam.
- Don’t try to trick members or the Woofer team into anything.
- If the problem is in a service Woofer relies on rather than in Woofer itself, please report it to that company too.
Woofer doesn’t offer a paid bug bounty. Every good-faith report still gets our genuine thanks.
What Woofer already does
- Row-level security in the database, so each request can only reach the member information it is allowed to.
- Independent security reviews of our code and database, with the fixes they found shipped to the live site.
- Encrypted connections only: HSTS tells browsers to always use HTTPS with Woofer.
- New accounts confirm their email address before they can sign in.
- Deleted accounts are purged, not just hidden, once the 14-day window to change your mind has passed.
- Woofer staff accounts that can moderate content or reach sensitive tools must also pass a second step, a one-time code from an authenticator app, before those actions are allowed.