Reporting a security problem

If you think you have found a security problem in gojob.now, please tell us. We read every report and we would much rather hear it from you than find out later.

How to report

Email offer@gojob.now with "Security" in the subject. English, Polish or Ukrainian are all fine. Please include:

• the page or address where it happens, and what you did, step by step;
• what you expected and what happened instead;
• how you would rate its impact, and any idea you have for a fix;
• how we can reach you, if not by replying to that email.

A short report with clear steps is worth more than a long one. Screenshots help; a working exploit against other people's data does not.

What is in scope

gojob.now and its subdomains, the app at gojob.now/app, its API, the Claude connector and the gojob.now Chrome extension. Problems in the services we use (for example payments or sign-in providers) belong with those companies, though we are glad to hear about them too.

Please do not

• look at, copy, change or delete anyone else's data. Use your own account, or two accounts of your own, to show a problem between users;
• run anything that slows the site down or takes it offline, or send automated traffic in volume;
• try to trick our users or team (phishing, social engineering), or test our offices or hosting providers;
• keep any personal data you came across. If you saw some by accident, stop, tell us what you saw and delete it;
• publish the problem before we have fixed it, or before 90 days have passed, whichever comes first.

What we do

• We reply within three working days to say we have your report.
• We keep you told about what we found and when it is fixed.
• If you followed this page in good faith, we will not take legal action against you or report you for it.
• With your agreement, we thank you by name once the fix is out.

What we do not do

We do not run a paid bug bounty. We never pay for a report as a condition of hearing about it, and we do not answer demands for money in exchange for keeping a problem quiet or for deleting data. Those go to the police.

The same contact details are in machine-readable form at /.well-known/security.txt. For questions about your personal data rather than security, see our privacy policy.