Responsible Disclosure

Report a security issue privately

Email support@nestpatrol.com with the subject Private security report. Include the affected URL or component, steps to reproduce, expected and observed behavior, and the least amount of test data needed to explain the issue.

Please do not

• Access, download, change, or share another family’s data.
• Use denial-of-service testing, destructive actions, social engineering, spam, or physical attacks.
• Test with real child information or include customer data in email.
• Publish an unresolved issue before NestPatrol has a reasonable opportunity to investigate and respond.

What to expect

NestPatrol will acknowledge valid reports when the monitored mailbox receives them, investigate in good faith, and coordinate next steps where appropriate. This policy does not authorize activity that violates law or harms users.

Safe harbor

If you follow this policy in good faith, we will not pursue legal action against you or report you to law enforcement for your research. If a third party brings action against you for activity that followed this policy, we will make that clear. This does not cover activity that accesses another family’s data, damages systems, or breaks the law.