Security

Security at SHY

Security work at SHY is continuous. This page covers how to report a vulnerability and, in plain language, how we protect the service.

Reporting a vulnerability

If you believe you have found a security vulnerability in SHY, email [email protected] with "Security report" in the subject. Include steps to reproduce and the impact you believe it has. We commit to acknowledging reports within 5 business days, keeping you informed while we investigate, and crediting reporters who wish to be credited once an issue is resolved.

Testing ground rules

• No denial-of-service testing and no automated scanning against production.
• Never access, modify, or delete another person's data. Use accounts you created.
• No social engineering of SHY staff or users, and no physical attacks.

Good-faith research within these rules will not be met with legal action by SHY.

How SHY protects data

• Encryption in transit and at rest. All traffic is served over TLS; data is stored on infrastructure that encrypts at rest.
• Server-side authority. Sensitive actions — who can message whom, who appears in discovery, consent between partners — are decided by server-side code and database row-level security, not by the app on your phone.
• Least-privilege access controls. Database access is governed by row-level security policies; privileged functions are restricted and audited, with automated checks that fail our builds when a new privileged function is left open.
• Message protection. New message threads use device-held keys for end-to-end protection of message content, with server-side access controls on every thread.

SHY does not currently hold third-party certifications such as SOC 2 or ISO 27001, and does not claim them.

Last reviewed: August 19, 2026.