How to report
Email with “Security” in the subject. Tell us what you found, where (the page, feature or address), the steps to reproduce it, the impact you think it has, and how to reach you. Please keep the details out of public issues and social posts until we've fixed it.
In scope
- tufu.ai: the website, the app, the docs and sign-in.
- The chat widget and the Ask console served from tufu.ai, and the bot pages they load.
- The emails tufu sends, and the addresses that receive replies.
- The tufu Slack app.
Out of scope
- Our customers' own websites. If you find a problem there, tell the site's owner.
- The third-party services we use, such as hosting, email, payment and sign-in providers. Report those to them.
- Denial of service, load or volume testing, and spam.
- Social engineering or phishing of our team or our customers, and physical attacks.
- Scanner output, missing headers or best practices, with no way shown to exploit them.
- Problems that need a compromised device, or that only affect yourself (self-XSS).
What we ask
- Test with your own account and your own team. A free account is fine.
- Never access, change or delete data that isn't yours. If you reach someone else's data by accident, stop, don't keep it, and tell us.
- Don't slow tufu down for anyone else, and leave our customers' sites and visitors alone.
- Give us a reasonable time to fix it before you go public.
What to expect
- We read every report and reply as soon as we can.
- We'll credit you when we talk about the fix, if you'd like us to.
- We don't run a bounty program.
Safe harbor
If you make a good-faith effort to follow this policy, we consider your research authorized. We won't take legal action against you or report you to law enforcement for it, and if someone else does over research that followed this policy, we'll make it known that it was authorized. If you're not sure whether something is allowed, ask us first at .
Our machine-readable contact is in security.txt.