Vulnerability Disclosure Policy

We welcome reports from security researchers. If you believe you've found a vulnerability in Socira AI, please tell us so we can fix it and protect our customers.

1. How to report

Email thetechhackerlabs@gmail.com with a description, the affected URL or feature, steps to reproduce, and the impact you believe it has. Our contact details are also published in /.well-known/security.txt (RFC 9116).

2. What to expect

• Acknowledgement within 3 business days;
• An initial assessment within 10 business days;
• Updates while we work on a fix, and credit (if you'd like it) once it's resolved.

3. Safe harbour

If you make a good-faith effort to follow this policy, we will not pursue legal action against you or ask law enforcement to investigate, and we will treat your research as authorized. Please:

• only test against your own account or accounts you have permission to use;
• never access, change or delete other customers' data; stop and report as soon as you see someone else's data;
• not run denial-of-service, spam, social-engineering or physical attacks;
• give us reasonable time to fix the issue before sharing details publicly.

4. Out of scope

Missing best-practice headers without a demonstrated impact, self-XSS, clickjacking on pages without sensitive actions, rate limiting on non-sensitive endpoints, reports from automated scanners without a proof of concept, and vulnerabilities in the social networks themselves (please report those to the network).