Security
Report a Security Issue
Found a weakness in TwiDi? Tell us first, privately, so we can fix it before anyone gets hurt. We read every report.
How to Report
Email security@twidi.app with what you found and where, the steps to see it again, what someone could do with it, and how to reach you. Leave out other people’s personal details.
Email security@twidi.appWhat We Promise
We Reply Within 3 Working Days
And we keep you told while we fix it.
We Won’t Take Legal Action
Against research done in good faith that keeps to the rules below.
We Thank You by Name
Once it’s fixed, if you’d like. We don’t pay rewards yet.
The Rules
Use Your Own Accounts
Test only with accounts you own.
Stop at Other People’s Data
If you reach anyone else’s data, stop, don’t keep it, and tell us.
Don’t Slow TwiDi Down
No flooding and no load tests: riders and partners depend on it.
Leave People Alone
Don’t trick our staff, riders or partners, and leave phones, cars and shops alone.
Give Us Time
Let us fix it before you tell anyone else.
What’s Included
Included
twidi.app and every page on it · admin.twidi.app · the TwiDi rider and partner apps · the TwiDi servers they talk to
Not Included
Paystack, Google, Apple and other companies’ own systems — tell them directly · scanner output with no sign of real harm
Security researchers’ tools look for this page at twidi.app/.well-known/security.txt.