Responsible disclosure

How to report

Email contact@aiactivesupport.com with "Security report" in the subject. Please include:

• what you found and where (URL, endpoint, feature);
• the steps to reproduce it, and what an attacker could do with it;
• your name or handle if you would like to be credited.

Please do not open a public issue or share the details with anyone until we have fixed it.

What you can expect

• A reply from a person confirming we received your report.
• Updates while we investigate and fix it, and a message when it is fixed.
• Credit for your finding, if you want it, once it is fixed.

We do not run a paid bug bounty programme at the moment.

In scope

• This website and the AI Active Support portal (/app, /admin, /agent), and their APIs.
• The website chat widget, and the webhooks AI Active Support receives (email, Shopify, Stripe, WhatsApp, Instagram, Messenger).
• Above all: anything that lets one brand see another brand’s data, or a person act beyond their role.

Please do not

• access, change or delete data that is not yours: use your own test account and organization;
• run denial-of-service, load or spam tests, or send messages to real customers;
• use social engineering, phishing or physical attacks against our team or clients;
• test the infrastructure of our providers (Vercel, Supabase, Stripe, Shopify, Meta) through AI Active Support: report to them directly.

Usually not accepted

• Reports from automated scanners without a demonstrated impact.
• Missing best-practice headers or settings with no exploitable consequence.
• Rate limits that are slower than you would like, or self-XSS.