Protections in the application
The application uses parameterised database queries, server-side access checks, CSRF tokens, password hashing, verified-email requirements, rate limits, restricted image processing, and security headers. Private chat and ownership clues are encrypted in server storage. This is not end-to-end encryption.
Protect your account
Use a unique password of 12–72 bytes, keep your email account secure, and never share reset links or verification codes. Log out on shared devices. Reunite support will not ask for your password or demand payment to release an item.
Report a vulnerability privately
Contact support with the affected URL, a clear description, and minimal reproduction steps using only accounts and data you own. Stop if you encounter someone else’s data. Do not attach stolen records or publicly disclose secrets.
Testing boundaries
This notice is not authorisation to attack the live service. Do not run mass scans, denial-of-service tests, social engineering, credential stuffing, or malware uploads without written permission from the operator. There is no guaranteed bounty or response deadline.
Security limitations
No web application can promise immunity from hacking, malware, or distributed denial-of-service attacks. The operator must maintain hosting protections, updates, backups, monitoring, and incident response. Content moderation is not an antivirus service.
Authenticators and active sign-ins
Open Account security from your dashboard to set up an authenticator and review active sessions. Two-step verification is required for administrators and optional for members. Save the recovery codes safely: each works once with your password. Email password reset does not remove an enrolled authenticator. New-browser/network notices appear in your account activity and can also reflect legitimate mobile or VPN changes.
Contact the operator
Drishnev Singh
drishnevsingh@gmail.com