Reporting a security issue
Last updated 9 October 2026.
A household’s plan holds what it earns, owns and intends. If you find a way that could expose any of it, we want to hear from you, and we will work with you to fix it.
How to report
Email security@longspan.app with what you found, the steps that reproduce it, and what you think it could reach. A short report sent soon is better than a polished one sent late.
Please keep it between you and LongSpan until it is fixed. Tell us if you plan to write about it, and we will agree a date with you.
What happens next
A reply within 3 business days. A person reads every report and tells you it arrived.
An assessment within 10 business days. We tell you whether we could reproduce it, how serious we think it is, and what we plan to do.
A fix on a deadline. Critical issues are fixed within 7 days and high ones within 30. We tell you when the fix ships, and if a household’s data was reached, we tell that household as the law requires.
What is in scope
longspan.app, dash.longspan.app, api.longspan.app including the assistant connector at /mcp, and the LongSpan apps for iPhone and Android.
Out of scope: the services LongSpan relies on (Plaid, WorkOS, Railway, Vercel, Apple, Google, Stripe, RevenueCat; report to them directly), denial of service or load testing, social engineering of anyone, physical attacks, and reports from automated scanners without a demonstrated impact.
The rules
Test only with an account and a household you created yourself. Never try to reach another household’s data.
If you reach data that is not yours, stop, do not keep or share it, and tell us what you saw.
Do nothing that degrades the service for anyone else, and do not change or delete data you do not own.
Safe harbor
If you research in good faith and keep to the rules above, LongSpan will not pursue or support legal action against you for that research, and will consider it authorized. If someone else brings a claim about research that kept to these rules, we will say so.
Everything else
LongSpan pays no bounty. With your permission we will thank you by name when the fix ships.
How LongSpan protects a household’s plan is in the privacy policy. LongSpan is run by SetForth LLC.