Vulnerability Disclosure Policy

1. Scope

In scope: shinobiops.ai, app.shinobiops.ai and the ShinobiOps public API at https://app.shinobiops.ai/api/.

Out of scope: third-party providers, including Clerk, Stripe, OpenRouter, Hetzner, Cloudflare, Google and PostHog; denial of service; social engineering; and physical attacks.

2. Research rules

Use only your own test accounts. Do not access another customer’s data. Stop testing once you have a proof of concept. If you encounter data belonging to another person, stop immediately, report the issue without disclosing that data, and delete any data obtained.

3. How to report

Email security@shinobiops.ai with the affected URL, steps to reproduce and the impact. Do not include credentials in the first email. Ask for a secure channel before sending sensitive evidence.

4. Response and coordinated disclosure

We will acknowledge reports within 5 Business Days and provide status updates as the investigation progresses. A Business Day is a day other than Saturday, Sunday or a public holiday in England.

Coordinate disclosure with us and allow a 90-day window from your report for investigation and remediation before public disclosure, unless we agree otherwise.

5. Safe harbour and bounty

We will not take legal action against you for good-faith security research conducted within this policy’s scope and rules. This commitment applies to ShinobiOps; it does not authorise testing third-party systems or bind third parties.

There is no monetary bounty programme.