Report a vulnerability

We want to hear about security vulnerabilities in Waffenschrank before anyone exploits them — in the app for iPhone, iPad and Android, in the web app, on this website and in the servers behind them. If you find a weakness and tell us first, you protect everyone who trusts the app with their inventory.

How to report a vulnerability

Write to kontakt@waffenschrank.app, ideally with the subject “Security”, in English or German. Helpful details:

• which part is affected (app with version and device, web app, website, address)
• the steps to reproduce it
• what an attacker could achieve with it
• whether you have signs that it is already being exploited
• how we can reach you if we have questions

The same details in machine-readable form are at /.well-known/security.txt.

What we commit to

• We confirm receipt within three working days.
• You get a first assessment within ten working days.
• We keep you informed until the vulnerability is fixed.
• We agree with you when details are published. The guideline is 90 days after your report or the fix, whichever comes first.
• If you wish, we credit you as the finder once it is fixed.
• If a vulnerability is actively exploited, we report it as the EU Cyber Resilience Act requires and inform the users affected.

Rules for your testing

• Test only with your own account and your own data.
• Do not access, change or delete other people’s data. If you come across it by accident, stop immediately, keep nothing and tell us.
• No load or denial-of-service testing, no spam, no automated mass requests.
• No deceiving people (social engineering) and no attacks on people or premises.
• Keep the details to yourself until the vulnerability is fixed.

If you follow these rules

If you research in good faith under these rules and report the vulnerability to us first, we will not take legal action or file a criminal complaint against you because of that research.

This commitment covers us only. It does not bind any authority or other companies whose services we use — such as Apple, Google, Cloudflare or Supabase; their own rules apply to their systems.

What does not belong here

• We do not pay rewards; there is no bug bounty program.
• Questions about using the app and bugs without a security impact: Support.
• Report illegal content in a showcase or on a club page under the terms of use for showcases and club posts.

Security advisories

We publish advisories about fixed vulnerabilities that affect users on this page. As of October 2026: none.

Contact

tap & type UG (haftungsbeschränkt), kontakt@waffenschrank.app; our postal address is in the legal notice.