Report a security problem
How to tell us about a flaw in RealAnalytica, and what happens next.
If you think you've found a way to reach data or actions you shouldn't, we want to hear about it. This page says what to send, what to leave alone while you test, and when you'll hear back.
Last updated: October 2026
How to report
Write to us through the contact form. Start the message with the words “Security report” so we don't mistake it for a sales question. Tell us:
- What the problem is, and what an attacker could do with it.
- Where it is: the page, URL, or API route.
- The steps to reproduce it, and which account you used.
- Any request, script, or screenshot that shows it working.
The form takes plain text. If you need to send files, say so and we'll reply with a way to share them.
What happens next
We'll confirm we got your report within three business days. We'll tell you whether we can reproduce the problem, keep you told while we work on it, and let you know when the fix is live.
What's in scope
- realanalytica.com and its subdomains, including the API routes our web and mobile apps call.
- Our mobile apps.
Out of scope:
- Services other companies run for us, such as Supabase, Vercel, Stripe, Google, and Microsoft. Report those to the company that runs them.
- Output from an automated scanner, with no sign of real harm.
- Gaps we already describe on our Security and trust page, such as the inline scripts our content security policy still allows.
- Denial of service, load testing, tricking our staff or customers, and physical attacks.
Rules while you test
- Use only accounts you own, or that the owner has said you may use.
- Don't view, change, or delete other people's data. If you reach it by accident, stop, don't keep a copy, and tell us what you saw.
- Don't send email, texts, or calls to people who haven't agreed to them. The product sends real messages, so point any test at addresses and numbers you control.
- Don't slow the service down or run high-volume scans.
- Keep the details private until we have fixed the problem.
Rewards
We don't run a paid bug bounty, so we can't pay for reports.