Report a security vulnerability

If you believe you have found a security vulnerability in SaaSy, we want to hear about it. Email security@hellosaasy.ai with enough detail to reproduce the issue: the affected URL or endpoint, the steps you took, and what you were able to do that you should not have been. Encrypted mail is welcome — ask and we will exchange keys.

The machine-readable version of this policy is published at /.well-known/security.txt (RFC 9116).

What you can expect from us

• Acknowledgement from a human within 3 business days.
• A triage verdict — valid or not, and at what severity — within 10 business days.
• Progress updates at least every 10 business days while the report is open, and a note when the fix ships.
• Credit in our release notes if you want it, under the name or handle you choose.

We do not run a paid bug bounty. We are not going to pretend otherwise to attract reports we could not pay for.

Safe harbour

If you make a good-faith effort to follow this policy while researching and reporting an issue, we will treat your research as authorised. We will not pursue or support legal action against you, and we will not ask your hosting provider or employer to act against you. If a third party brings action against you for research that stayed inside this policy, we will say publicly that it was authorised.

This protection covers only the activity described here, and only for the systems listed as in scope. It does not waive the rights of our customers, and it does not license access to data that is not yours.

Rules

• Use only accounts and data you own. Create your own trial tenant rather than probing someone else’s.
• Stop as soon as you have proved the issue. Do not read, copy, alter, or delete data that is not yours.
• Do not degrade the service for anyone else — no load testing, no automated brute force, no spam.
• Give us a reasonable chance to fix it before you publish, and tell us when you plan to.

In scope

• app.hellosaasy.ai — the tenant dashboard and its public pages
• portal.hellosaasy.ai — the customer portal, including tenant custom domains
• api.hellosaasy.ai — the public API and webhook endpoints
• Authentication, session handling, and OAuth/SSO flows
• Tenant isolation: any way to read or write another tenant’s data
• Billing, quota, and entitlement bypasses

Out of scope

We will close these without a fix. Reporting them anyway is not a breach of the policy, but it will not get a severity.

• Findings from automated scanners with no demonstrated impact
• Missing security headers, cookie flags, or TLS configuration with no working exploit
• Rate limiting, brute force, or denial of service — including volumetric or stress testing
• Social engineering, phishing, or physical attacks against our staff or customers
• Reports about software we do not run, or about third-party services we merely integrate with
• Self-XSS, clickjacking on pages with no sensitive action, and missing SPF/DKIM/DMARC on non-mail domains
• Vulnerabilities requiring a rooted or malware-compromised device, or a browser we do not support

For how we handle your business data day to day, see how we handle your data.