Agoré is an early-stage social platform under active development. It handles account information, user-generated content, private conversations, and other potentially sensitive data.

Security reports are welcome. Please report suspected vulnerabilities privately so they can be investigated without unnecessarily exposing users or the platform to risk.

Security contact: agore.support@gmail.com

Use the subject line:

Security Vulnerability — Agoré

When reporting a vulnerability, please include:

• A brief description of the issue and its potential impact.
• The affected feature, route, API, or component, if known.
• Steps to reproduce the issue using accounts or systems you are authorised to test.
• Relevant screenshots, error messages, or sanitised logs.
• A suggested remediation, if you have one.

Please do not include passwords, session tokens, private keys, or unnecessary personal information in your report.

Do not publish suspected vulnerabilities in public issues, discussions, or social media before giving the Agoré team a reasonable opportunity to investigate.

Security testing must be limited to systems and accounts you own or are explicitly authorised to test.

Please do not:

• Access, collect, modify, or delete another person's data without authorisation.
• Attempt to take over accounts or bypass access controls against real users.
• Disrupt services, conduct denial-of-service testing, or perform destructive tests.
• Use phishing, impersonation, social engineering, or other attacks against users or staff.
• Publicly disclose sensitive findings before coordinating with the team.
• Access or test third-party infrastructure outside the scope of your authorisation.

If you unexpectedly encounter another person's private information, stop testing, do not retain or share the information, and report the incident privately.

The Agoré team will assess reports in good faith and prioritise investigation according to severity, potential impact, and available resources.

Agoré is an early-stage project, so acknowledgement, investigation, and remediation timelines cannot be guaranteed. Please provide enough information for the team to validate the report safely.

No public bug bounty programme or reward is currently offered. Reporting a vulnerability does not, by itself, grant permission to conduct additional testing or establish a legal safe harbour.

This policy covers security issues in the Agoré application and systems that the Agoré team operates or explicitly authorises for testing.

Vulnerabilities in third-party services should also be reported to the appropriate service provider when applicable. Please do not assume that permission to test Agoré extends to Supabase, Vercel, authentication providers, or other external infrastructure.

Agoré is currently pre-release. There is no formally declared stable-version support window. Reports concerning the current application and its deployed functionality are welcome; support for old snapshots, forks, or modified copies is not guaranteed.

For security concerns, contact agore.support@gmail.com with the subject line Security Vulnerability — Agoré.

For ordinary account assistance or product feedback, use the normal Agoré support channel.