Security

If you have found a weakness in Goltrik, thank you for telling us. This page says how to report it and what we do with it.

Report a vulnerability

Email [SECURITY EMAIL]. [PGP KEY: optional, a public key and its fingerprint for encrypted reports]

Please include:

• what you found and where (the app, goltrik.com, or our server functions);
• the steps to reproduce it, and what an attacker could do with it;
• the app version, if you know it, or the page address;
• how to reach you, and whether you want to be thanked by name.

Do not include other people's personal data. If you came across some, tell us what kind it was, not the data itself.

What we promise

• We confirm we received your report within [ACK TIME: proposed 3 working days].
• We tell you what we found and our plan within [TRIAGE TIME: proposed 10 working days].
• We fix serious issues as fast as we can and tell you when the fix ships.
• We agree a disclosure date with you. Unless we agree otherwise, you may publish 90 days after your report, or when the fix ships, whichever comes first.
• We do not pursue or report anyone who acts in good faith under the rules below.

Goltrik is run by one person, so there is no bug bounty. We are glad to thank you on this page.

Good-faith rules

• Test only against your own accounts. Do not access, change or delete other players' data.
• Stop as soon as you have shown the problem. Do not keep, copy or share data you reach.
• Do not degrade the service: no denial-of-service, no flooding, no automated scanning that loads our servers.
• No social engineering, phishing or physical attacks on anyone.
• Give us reasonable time to fix it before you tell anyone else.

What is in scope

• The Goltrik app for iOS and Android.
• goltrik.com and its pages.
• Our server functions and database rules (the backend the app and the page talk to).

Not in scope: the platforms we build on (Supabase, Cloudflare, Apple, Google, Expo). Please report their issues to them directly. Cheating in the game that does not involve a security flaw is welcome too, as a report in the app ("Unfair or broken") or by email.

How we handle security incidents

Goltrik is a product with digital elements under the EU Cyber Resilience Act (Regulation (EU) 2024/2847). Since 11 September 2026 its reporting duties apply to us. In practice:

• Actively exploited vulnerabilities and severe incidents are reported through the EU's single reporting platform to the competent national computer security team and to ENISA: an early warning within 24 hours of our becoming aware, a notification within 72 hours, and a final report within 14 days after a fix is available (one month for an incident).
• Affected players are told without undue delay, with what they can do to protect themselves.
• Personal data breaches are also reported to the data protection authority within 72 hours where the law requires it, and to affected players when the risk to them is high.
• Security updates are provided free of charge for the support period: [SUPPORT PERIOD: at least five years from the release of each version, unless the product is expected to be used for less; to be stated before 11 December 2027]. When an update fixes a serious problem, the app may require it before you can keep playing.

What we already do

• Every table in the database is closed by default and opened only for what the game needs (row-level security), and the server checks every answer: the app never decides a result.
• The app holds no secret keys. Video links are signed by the server for one player and expire after 10 minutes.
• IP addresses are never stored; abuse limits use keyed fingerprints with a key we rotate every quarter.
• Every request is rate-limited per account or per network.
• A minimum app version is enforced by the server, so a fix can be required.
• Data is hosted in the EU (Frankfurt) and encrypted in transit.

[SECURITY TXT: publish /.well-known/security.txt (RFC 9116) pointing to this page and the security email once the address exists]