At Swarmia, we take security seriously. We appreciate the efforts of security researchers in helping us maintain a secure environment for our customers.

Scope

• Swarmia's primary application domain at app.swarmia.com
• All production infrastructure and services

Submission Guidelines

Please report security vulnerabilities by emailing security@swarmia.com. Include:

• Clear description of the vulnerability
• Steps to reproduce
• Potential impact
• Any relevant screenshots or proof of concept

If your report contains sensitive details, you can encrypt it with our public key. We'll acknowledge your report and keep you updated as we investigate and fix the issue.

Rules of Engagement

• Only test against accounts you own or have permission to use
• Don't access, modify, or keep data belonging to other customers. If you come across such data, stop and report it to us right away
• Don't run high-volume or automated testing that could degrade the service for others
• Don't disclose the vulnerability publicly until we've fixed it and agreed on disclosure with you

Safe Harbor

This safe harbor supports the protection of security researchers engaged in Good Faith Security Research. “Good Faith Security Research” is accessing a computer solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability, where such activity is carried out in a manner designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices, machines, or online services to which the accessed computer belongs or those who use such devices, machines, or online services.

We consider Good Faith Security Research to be authorized activity that is protected from adversarial legal action by us. We waive any relevant restriction in our Terms of Service that conflicts with the standard for Good Faith Security Research outlined here.

This means that for Good Faith Security Research conducted with a good faith effort to comply with this policy and while this policy is in effect, we:

• Will not bring legal action against you or report you, including for bypassing technological measures we use to protect the applications in scope; and,
• Will take steps to make known that you conducted Good Faith Security Research if someone else brings legal action against you.

You should contact us for clarification before engaging in conduct that you think may be inconsistent with Good Faith Security Research or unaddressed by this policy.

Keep in mind that we are not able to authorize security research on third-party infrastructure, and a third party is not bound by this safe harbor statement.

Out of Scope

• Our marketing website at www.swarmia.com
• Denial of Service attacks
• Physical security attacks
• Social engineering attacks
• Third-party services/applications
• Findings from automated vulnerability scanners
• Missing security headers or cookie flags without a working exploit
• SPF, DKIM, or DMARC configuration
• Clickjacking on pages without sensitive actions
• Self-XSS and issues that require a compromised device or browser
• Missing rate limiting without demonstrated security impact
• Software version disclosure and banner information
• CSV or formula injection

Rewards

We pay rewards only for validated vulnerabilities of high or critical severity, at our discretion. We assess severity based on the real-world impact on our customers and their data, and how complex the issue is to exploit. The reward amount also depends on the quality of the report.

We don't pay rewards for low or medium severity findings, but we still appreciate the reports and will fix valid issues.

Only the first report of a given issue is eligible for a reward, and reports that don't follow this policy aren't eligible.

For questions about this policy, contact security@swarmia.com.

Last updated: October 27, 2026