Reporting a security issue

Last updated: 8 October 2026

If you think you have found a security problem in Lingara, we want to hear about it. This page explains how to tell us, what is in scope, and what you can expect from us in return.

How to report

Email security@getlingara.com. Tell us what you found, where it is (a URL, an app version or an API endpoint), the steps to reproduce it, and what an attacker could do with it. Please write in English if you can. Do not send other people's personal data beyond what you need to show the problem.

In scope

getlingara.com, app.getlingara.com, api.getlingara.com (and its older name, vocabapp.spinningcatstudios.com), and the Lingara apps for Android and iOS. Only these are in scope.

Out of scope

  • Denial-of-service and volumetric testing, or anything else that degrades the service for other learners.
  • Social engineering, phishing, or physical attacks against us, our learners or our providers.
  • Output from automated scanners that does not demonstrate an issue you can actually exploit.
  • Vulnerabilities in third-party services we use, such as our payment, email or analytics providers. Please report those to the provider.

Safe harbour

If you act in good faith, we will not take or support legal action against you for your research, and we will treat your report as help. Acting in good faith means that you test only against your own account or accounts you have permission to use, access no more data than you need to show the problem, stop and tell us if you come across another learner's data, do not change or destroy data, do not disrupt the service, and give us reasonable time to fix the issue before you tell anyone else.

Rewards

Lingara does not run a paid bug bounty, and we do not pay for reports. What we offer is a prompt, honest reply and a fix.

What happens next

We will acknowledge your report within 5 business days, tell you whether we could confirm the issue, and let you know when it is fixed. If you have not heard from us within 5 business days, please write again, because mail does sometimes go astray.

This policy is written in English. Translations are provided for convenience; in case of conflict, the English version prevails.