Security

We welcome reports from security researchers. If you have found a vulnerability in RovePort, please tell us.

How to report

Email security@roveport.com. Our machine-readable policy is at /.well-known/security.txt. Please include the affected URL, the steps to reproduce, and the impact you observed.

Scope

roveport.com and its subdomains. Third-party services we rely on (for example our email or analytics providers) are covered by their own programmes — please report those to the provider.

Good-faith safe harbour

We will not pursue or support legal action against researchers who act in good faith: who make a reasonable effort to avoid harm to people, data and service availability, who do not access more data than needed to demonstrate an issue, and who give us a reasonable time to fix it before disclosing publicly. Do not run denial-of-service tests, and do not access, modify or delete other people's data.

What to expect

We aim to acknowledge a report within 5 business days. There is no paid bounty at this stage; we are grateful for the help and will credit you if you would like.

Last updated 21 September 2026.