Security
Found a security issue? Report it here.
Email Support_MCPatrol@DetentPoint.com
with the subject "MCPatrol security report". Include what you found, how to
reproduce it, and what you think the impact is. Machine-readable contact details live at
/.well-known/security.txt (RFC 9116).
What to expect
- An acknowledgment within 72 hours, from the person who wrote the code.
- A fix timeline appropriate to the severity — credential or data-isolation issues jump the queue ahead of everything else.
- Credit here, if you want it, once a fix ships. No bug bounty exists at this stage; that's a budget statement, not a valuation of your work.
Scope
- The MCPatrol Android app (package
com.moc.mobile) - The MCPatrol backend API and the PC bridge agent
- This website
Please don't run volumetric/denial-of-service tests against the backend, and don't access data that isn't yours — a proof-of-concept against your own account is always enough.
Measures currently in place
- TLS on every connection; passwords stored as salted PBKDF2 hashes; API keys stored only as SHA-256 hashes server-side and as Android-Keystore-encrypted ciphertext on the device.
- Per-account data isolation on every endpoint; in-app deletion purges all server data.
- CI on every commit: full-history secret scanning and dependency vulnerability scanning.
- Status against OWASP MASVS is tracked control-by-control in the repository, including the open gaps.
- Dependency inventory published as a CycloneDX SBOM; GDPR/CCPA rights and in-app deletion covered in the privacy policy.