Security & Vulnerability Disclosure

MoveTwo handles private data for couples searching for their next home. We take that responsibility seriously. If you’ve found a potential security vulnerability in our app, extension, or website, we want to hear from you.

How to report

Email us at security@movetwo.app with:

• A description of the vulnerability
• Steps to reproduce it
• The potential impact as you see it
• Any supporting screenshots or files

What happens next

1. We’ll acknowledge your report within 48 hours.
2. We’ll investigate and keep you updated on progress.
3. We’ll fix the issue and let you know when it’s resolved.

Our commitment to you

We treat every report with confidentiality. We won’t pursue legal action against anyone who reports vulnerabilities in good faith and follows these guidelines. We ask that you do the same — please keep the details private until we’ve resolved the issue together.

We don’t currently offer financial rewards, but we genuinely appreciate every report. You’re helping protect real people’s private data.

What’s in scope

• movetwo.app and app.movetwo.app
• The MoveTwo Chrome extension
• Our API and backend infrastructure

What’s out of scope

• Social engineering or phishing attacks
• Denial of service attacks
• Issues on third-party services we use

Questions? Email security@movetwo.app