Version 1.0 of 3 November 2026, effective on publication. Any material change is announced at least 30 days in advance. This is a translation: the Italian text prevails.

Reporting a vulnerability

If you find a vulnerability in ERERE, please tell us: you protect thousands of people. We commit not to take legal action against anyone reporting in good faith under these rules.

How to report

• Write to fishmania@pec.it with the subject “Security”, describing the issue and how to reproduce it.
• We reply within 3 working days and keep you updated until it is fixed.
• Please do not disclose the issue before it is fixed, or in any case before 90 days from your report.

In scope

• ERERE's website and APIs, the ERERE apps, the phone-to-phone Network and the encryption of the Archive and messages.

What not to do

• Do not access, modify or delete other people's data: use only your own accounts.
• No attacks that degrade the service (denial of service), social engineering or physical access.

Acknowledgement

With your consent we thank you publicly on the security page. The security.txt file lists these contacts in the standard format (RFC 9116).

Contact

fishmania@pec.it · Terms of Service · Privacy Policy