Vulnerability Disclosure Policy

How to report an issue

At WIGGWIGG, security isn’t just a feature: it’s the promise at the heart of the product. If you think you’ve found a flaw, we want to know.

Email us at security@wiggwigg.ca and tell us:

• how to reproduce it;
• the impact you see;
• the test account you used.

You don’t need a perfect report: a clear email is already plenty to get started. For a sensitive report, ask us for an encrypted channel.

WIGGWIGG is in invite-only Early Access. If you need a test account to look into something, ask and we’ll set one up.

Scope

What we cover:

• wiggwigg.ca
• app.wiggwigg.ca
• api.wiggwigg.ca
• our mobile apps

Out of scope:

• social engineering;
• physical attacks;
• denial of service (DoS or volumetric);
• spam;
• raw automated-scanner output without demonstrated impact;
• our third-party providers’ infrastructure (Vercel, AWS, Telnyx, SignalWire, Stripe);
• anything that reaches the phone network or emergency services (see the rules).

The rules

We’re a privacy company, so we ask you to respect privacy the way we do.

• Use your own or test accounts, never someone else’s data. To test cross-account access, use two accounts you control.
• Never place live calls or send messages over the phone network, even between numbers you control (it still costs us real money and can reach real people). Never dial 911 or any emergency service, and don’t exercise the E911 registration or dispatch flow. Number provisioning and anything else that generates real telecom traffic or charges is out of scope.
• Stop as soon as you’ve proven the flaw is real. No need to go further.
• If you ever come across another user’s data by accident, stop immediately, don’t view more than needed to confirm the issue, don’t save, download, or share it, tell us right away, and delete any copy once we confirm the fix. Accidental access reported in good faith is covered by our safe harbor.
• Don’t copy, modify, or destroy any data.
• No high-volume automated scanning against production.

What to expect

We aim to acknowledge within one business day. We’ll keep you posted on triage and the fix.

We ask that you keep it between us until the fix ships, or 90 days, whichever comes first. For a complex fix we may ask you for a bit more time, and we’ll agree on a date together.