# Reporting a security problem

If you think you have found a security problem in gojob.now, please tell us. We read every report and we would much rather hear it from you than find out later.

## How to report

Email offer@gojob.now with "Security" in the subject. English, Polish or Ukrainian are all fine. Please include:

- the page or address where it happens, and what you did, step by step;
- what you expected and what happened instead;
- how you would rate its impact, and any idea you have for a fix;
- how we can reach you, if not by replying to that email.

A short report with clear steps is worth more than a long one. Screenshots help; a working exploit against other people's data does not.

## What is in scope

gojob.now and its subdomains, the app at gojob.now/app, its API, the Claude connector and the gojob.now Chrome extension. Problems in the services we use (for example payments or sign-in providers) belong with those companies, though we are glad to hear about them too.

## Please do not

- look at, copy, change or delete anyone else's data. Use your own account, or two accounts of your own, to show a problem between users;
- run anything that slows the site down or takes it offline, or send automated traffic in volume;
- try to trick our users or team (phishing, social engineering), or test our offices or hosting providers;
- keep any personal data you came across. If you saw some by accident, stop, tell us what you saw and delete it;
- publish the problem before we have fixed it, or before 90 days have passed, whichever comes first.

## What we do

- We reply within three working days to say we have your report.
- We keep you told about what we found and when it is fixed.
- If you followed this page in good faith, we will not take legal action against you or report you for it.
- With your agreement, we thank you by name once the fix is out.

## What we do not do

We do not run a paid bug bounty. We never pay for a report as a condition of hearing about it, and we do not answer demands for money in exchange for keeping a problem quiet or for deleting data. Those go to the police.

The same contact details are in machine-readable form at [/.well-known/security.txt](https://gojob.now/.well-known/security.txt). For questions about your personal data rather than security, see our [privacy policy](https://gojob.now/privacy).