Introduction

We would rather hear about a vulnerability from you than from an incident. This policy tells you where to send a report, what we commit to in return, and what is in and out of scope.

We do not currently run a paid bug bounty. We do acknowledge every valid report, and we will credit you publicly if you would like us to.

How to Report a Vulnerability

Email support@oyechats.com with "Security" in the subject line. A useful report includes:

The affected component and URL or endpoint.
Steps to reproduce, ideally with a proof of concept.
What an attacker could achieve, and any prerequisites.
Your name or handle, if you would like to be credited.

Please report in English, and please send one issue per report.

What We Commit To

We acknowledge your report within 2 business days.
We give you an initial assessment, including whether we consider it in scope and our severity view, within 5 business days.
We keep you informed while we work on a fix, and tell you when it is deployed.
We aim to remediate critical issues within 7 days, high severity within 30 days, and everything else on a schedule we will share with you.
We will not take legal action against you for research conducted in good faith under this policy.

Safe Harbour

If you make a good-faith effort to comply with this policy during your research, we will treat your research as authorized, we will work with you to understand and resolve the issue quickly, and we will not pursue or support any legal action related to it.

To stay within safe harbour, you must:

Use only your own test accounts, and stop as soon as you can demonstrate the issue.
Not access, modify, export, or retain data belonging to any other customer or Visitor. If you encounter such data incidentally, stop, report it, and delete any copy.
Not degrade the Service: no denial of service, no load or stress testing, no automated scanning at volume.
Not use social engineering, phishing, or physical attacks against our staff, our customers, or our providers.
Give us a reasonable opportunity to remediate before disclosing publicly, and coordinate the timing with us.

Safe harbour covers our own systems only. It does not authorize testing against our sub-processors, or against a customer's website that happens to embed our widget.

Scope

In scope:

oyechats.com and app.oyechats.com.
Our REST and WebSocket APIs.
The embeddable chat widget and its CDN bundle.
The OyeChats mobile application for operators.

Particularly interesting to us: any cross-tenant data access, authentication or authorization bypass, extraction of another customer's system prompt or knowledge base, credit or entitlement bypass, and server-side request forgery through the URL ingestion feature.

Out of scope:

Reports from automated scanners with no demonstrated impact.
Missing security headers, cookie flags, or TLS configuration preferences with no demonstrated exploit.
Denial of service, rate-limit exhaustion, and volumetric testing.
Social engineering, phishing, and physical security.
Vulnerabilities in a third-party service we use; report those to that provider.
A customer's own website configuration, including how they have configured their bot or their consent banner.
Content a bot generates that is merely inaccurate or undesirable. That is a product report, not a vulnerability; send it to support@oyechats.com without the Security subject line.

Security Measures We Operate

Encryption. TLS 1.3 for all API, widget, and dashboard traffic. Encryption at rest for primary databases and object storage. Encrypted, rotated database backups.

Access control. Role-based access control, least-privilege provisioning, multi-factor authentication for production access, and separate credentials for each persona.

Tenant isolation. Every query is scoped to the owning account; knowledge bases and conversations are logically isolated between tenants.

Data minimization. Visitor IP addresses are stripped at every outbound boundary, including API responses, dashboard views, CSV exports, and third-party observability traces.

Monitoring. Audit logging of administrative and operator actions, immutable transition logs for live-chat handovers, application error monitoring, and platform health monitoring.

Environment separation. Production and non-production workloads run in separate environments with separate credentials.

We do not currently hold a SOC 2 or ISO 27001 certification, and we will not claim one until we do. We answer security questionnaires in writing, and the audit rights available to customers are set out in our Data Processing Addendum.

Contact

Security reports and questions about this policy: support@oyechats.com, with "Security" in the subject line.

Security and Responsible Disclosure Policy