Responsible disclosure.

Authentication boundary

SharetoBoard Beta supports Poppy email-and-password sign-in only. The current Poppy/Clerk integration does not provide a supported way to return a completed Google sign-in session to SharetoBoard's embedded experience.

SharetoBoard blocks Google sign-in navigation instead of extracting, copying, or relaying Google or Clerk identity tokens. Google sign-in may be reconsidered only through a provider-supported native handoff or a first-party Poppy integration.

This is a limitation of the current independent integration. It is not a claim that Google sign-in is unsafe or that email/password is inherently more secure.

How to report

Email security@sharetoboard.com with:

• A clear description of the issue and why it matters
• Steps to reproduce (URLs, APK build, Android version)
• Any proof-of-concept, logs, or screenshots
• Your preferred contact and whether you want credit

If you need to send sensitive material, ask for a PGP key in your first message and we'll reply with one.

What we commit to

• Acknowledge your report within 3 business days.
• Keep you updated with a realistic timeline as we investigate.
• Fix confirmed issues as quickly as the severity warrants and ship a patch via Google Play.
• Credit you publicly (with your permission) once the fix is live.
• Never pursue legal action against good-faith researchers who follow this policy.

Please do not

• Access, modify, or delete data that isn't yours
• Run automated scanners that generate significant traffic
• Attempt denial-of-service, spam, or phishing
• Publish the issue before a fix is available and we've agreed on a disclosure date

Safe harbor

If you act in good faith, follow this policy, stop at proof-of-concept, and don't harm users or data, we will not consider your research a violation of our Terms of Use and will not pursue legal action. This is not a paid bug bounty, but credit and our sincere thanks are guaranteed.