Responsible Disclosure

Our commitment

When I Am Gone (Pty) Ltd ("WIAG") protects highly sensitive personal and estate information for South African families and practitioners. We rely on the security research community to help us find and fix issues that could put that data at risk. If you believe you have found a vulnerability, please tell us in line with this policy and we will work with you in good faith.

Safe harbour

We will not initiate legal action against researchers who:

• Make a good-faith effort to comply with this policy and avoid privacy violations, data destruction, and service interruption.
• Report the issue to us promptly and give us reasonable time to remediate before public disclosure.
• Do not exploit a vulnerability beyond the minimum needed to demonstrate it.
• Do not access, modify, exfiltrate, or retain data belonging to other users.

If a third party brings legal action against you for activities that complied with this policy, we will make it known that your actions were authorised.

In scope

• wheniamgone.co.za and its subdomains.
• WIAG-operated APIs, web applications, and authentication flows.
• Vulnerabilities in our handling of vault data, audit logs, encryption keys, payments, and access tokens.

Out of scope

• Findings against third-party services we depend on (Paystack, Resend, Neon, and other vendors). Please report those directly to the relevant vendor.
• Theoretical issues without a working proof of concept, missing best-practice headers without a demonstrable impact, rate-limit findings, and findings from automated scanners without exploitation analysis.
• Social engineering, physical attacks, denial-of-service, and attacks requiring privileged access to a victim's device or account.
• Content spoofing or text injection without an attached exploit chain.

What to include

• A clear description of the vulnerability and its impact.
• Steps to reproduce, including any required accounts or payloads.
• The URLs, parameters, and request/response samples involved.
• Your contact details and (optionally) a name or handle for credit.

What happens next

1. We acknowledge your report within two business days.
2. Our Information Officer triages the report and confirms the finding, severity, and remediation timeline within ten business days.
3. We keep you updated through remediation and notify you when a fix is deployed.
4. With your permission, we credit you publicly once the issue is resolved.

Bounties

WIAG does not currently run a paid bug bounty programme. We publicly thank researchers who follow this policy and may offer goodwill rewards at our discretion.

Information Officer

Natalie Macdonald Spence, security@wheniamgone.co.za

Machine-readable contact details are also published at /.well-known/security.txt.