Responsible Disclosure

Effective date: 28 August 2026

If you've found a security vulnerability in Unio, we'd genuinely like to know about it before anyone else does.

How to report

Email contact@myunio.in with:

• What you found and where (page/URL or API endpoint)
• Steps to reproduce it
• What you think the impact is

We'll acknowledge your email and follow up as we look into it.

Scope

In scope: the Unio web app at myunio.in and its subdomains, and its public-facing APIs.

Out of scope: our third-party providers' own infrastructure (Supabase, Vercel, PostHog, Google) — please report issues with those services directly to them. Also out of scope: social engineering, physical attacks, or denial-of-service testing against our systems.

What we ask

• Give us a reasonable amount of time to investigate and fix an issue before disclosing it publicly.
• Don't access, modify, or delete real user data beyond what's needed to demonstrate the issue.
• Don't run automated scanners that could degrade the service for real users.

What to expect from us

We don't currently run a paid bug bounty program — we're not going to claim one we don't have. We will engage in good faith with reports made in line with the guidelines above, and we won't pursue legal action against a researcher who reports a vulnerability responsibly and in good faith, within this scope.