wenlo
Vulnerability Disclosure Policy
Wenlo keeps families' — including children's — location data. If you find a
way that data could be exposed, we genuinely want to hear from you, and we'll treat you
with respect for telling us.
How to report
Email privacy@getwenlo.com with enough detail to
reproduce the issue: the endpoint or screen, steps, and what you observed. A proof of
concept helps; access beyond what's needed to demonstrate the issue doesn't.
You'll get a human reply within 3 business days — usually faster.
Our promise to good-faith researchers
- We will not pursue legal action against research conducted in good
faith under this policy, and we consider it authorized under the CFAA and similar laws.
- We'll work with you on a fix and, if you'd like, credit you when it ships.
- We follow 90-day coordinated disclosure: we ask that you give us up
to 90 days to remediate before public disclosure, and we'll keep you posted on progress.
In scope
- The Wenlo mobile apps (iOS and Android)
- Our APIs and backend (Firebase project surfaces reachable from the app)
- This website and its subdomains
Out of scope
- Denial of service, volumetric attacks, or spam
- Social engineering of our users or providers, and physical attacks
- Reports about third-party services we use (report those to the vendor — we'll gladly relay)
- Accessing, modifying, or retaining another family's real data — use your own test
accounts; if you stumble into someone else's data, stop and report immediately