How to report
Email [email protected] with a description of the issue, the steps to reproduce it, and its impact. Please include any proof-of-concept code or screenshots. You can write in English or Hindi.
Scope
In scope
- strangerfun.com and its pages
- Our signalling and API servers (the Cloudflare Worker the site connects to)
- The StrangerFun Android app (com.strangerfun)
Out of scope
Out of scope: third-party services we use (report those to the vendor), social engineering of our team, physical attacks, and denial-of-service testing.
Please
- Test only against your own sessions. Never access, modify or record other users’ chats, video or data.
- Do not run automated scanners that flood the matching service — real people use it.
- Give us reasonable time to fix the issue before disclosing it publicly.
What you can expect
An acknowledgement of your report.
Updates as we investigate and fix it.
Credit when the fix ships, if you want it.
We will not take legal action against good-faith research that follows this policy.
We do not currently run a paid bug bounty. Our machine-readable contact is at /.well-known/security.txt. For user safety issues (abuse, harassment) see the Safety page instead.