ResetRoom's strongest security control is scope: the sensitive data — your room photos — never leaves your iPhone, so it cannot be exposed by a server breach.
On the device
- Photos and local app history stay in protected iPhone app storage.
- Camera and photo-library access are requested only when used, and the app works with library-only access if you prefer.
- Purchases are verified through StoreKit 2, so no payment data reaches our systems.
On the API
- Transport. Production traffic uses HTTPS.
- Request integrity. App requests include platform integrity checks where supported.
- Payload limits. The API is designed to reject visual data and accept only the small request shapes needed by the app.
- Abuse controls. Rate limits and server-side checks protect shared services.
- Least data. Logs and analytics are kept limited and privacy-focused.
Operations
- Secrets are supplied as environment variables, never committed.
- Production configuration is reviewed before release.
- Operational checks avoid exposing sensitive configuration.
Report a vulnerability
Email [email protected] with the affected endpoint or app version, reproduction steps, and impact. We aim to acknowledge within three business days and will keep you updated until the issue is resolved.
Please test only against your own installation. Do not run denial-of-service tests, do not access other people's data, and give us reasonable time to ship a fix before publishing. We will not pursue action against good-faith research that follows this guidance.