Responsible disclosure
We welcome reports from security researchers. This policy explains what is in scope, how to report a vulnerability, and what to expect from us in return.
Scope
In scope: gochamie.com and its subdomains, and the web and mobile applications and public APIs of the brands GoChamie operates. Out of scope: social engineering of our staff or members, physical attacks, attacks on third-party services we do not control, and volumetric denial-of-service testing.
How to report
Email security@gochamie.com with a clear description of the issue, the steps to reproduce it, and the impact you observed. Encrypt your report if you wish; a PGP key is available on request. Please give us reasonable time to remediate before any public disclosure, and coordinate timing with us.
Safe harbor
If you make a good-faith effort to comply with this policy, we will consider your research authorized, we will not pursue or support legal action against you, and we will not report your activity to law enforcement. We will work with you to understand and resolve the issue. This safe harbor does not apply to activity that is malicious, that violates the privacy of our members, or that breaks applicable law.
Rules of engagement
Do not access, modify, or retain data that does not belong to you. If you encounter member personal data during testing, stop, do not download it, and report it to us. If you ever encounter apparent child sexual abuse material, stop immediately, do not download or copy it, and report it to us at once so we can act and report it to NCMEC.
What to expect
We acknowledge reports within two business days, triage promptly, and keep you updated through remediation. We aim to resolve high-severity issues quickly and to coordinate public disclosure with you once a fix is in place.
Out-of-scope findings
Low-impact findings, such as missing security headers without an exploitable consequence or denial of service of public marketing pages, are recorded but are not eligible for recognition.
Recognition
With your permission, we publicly thank researchers whose reports lead to material fixes.
Last updated 2026-06-13. Questions: legal@gochamie.com.
Building the systems that bring people together.
Questions about our brands, press, or partnerships? Send a note and we'll reply within two business days.