Book a call
Menu
Draft, pending legal review. Not in force. It applies only once approved and published as final. [Bracketed] text is a placeholder or a choice still to be made.
Security · draft

Reporting a security problem

All legal pages · Terms · Privacy Policy · Acceptable Use · Cookies · DPA · Subprocessors · Report a security problem

If you think you've found a security vulnerability in Digital Minions, please tell us. We want to hear about it, and we won't take legal action against good-faith research that follows these rules.

How to report it

  • Email: [security email]. [Optional: a PGP key.]
  • Tell us:
    • what you found;
    • where it is (the address or the feature);
    • the steps to reproduce it;
    • what an attacker could do with it.
  • Screenshots or a short video help.
  • Please don't put another person's data in the report. Describe it instead.

We will:

  • confirm we got your report within [3] business days;
  • tell you what we think, and our plan, within [10] business days;
  • tell you when it's fixed.

We will credit you when it's fixed, if you'd like that.

What's in scope

  • The Digital Minions app on a client's address. Use only a workspace you own, or one that you have the owner's written permission to test.
  • Nell's phone and web-call endpoints, the website chat and form endpoints, and the webhooks.
  • The marketing website.
  • Our code's handling of the secrets and data described in our Privacy Policy.

What's out of scope

  • Other companies' services: the AI providers, Twilio, Railway, Stripe and the rest. Report those to them.
  • Denial of service, load testing, spam, social engineering or phishing of our staff or clients, and physical attacks.
  • Reports from automated scanners with no proof that the issue can be exploited.
  • Missing best-practice headers on pages that hold no data, unless you can show real harm.

Rules for good-faith research

  • Only test accounts and data that are yours, or that you have written permission to use. Stop and tell us as soon as you reach anyone else's data. Don't keep it, share it or change it.
  • Don't make calls, send texts or send emails to real people through the service.
  • Don't degrade the service for others.
  • Give us reasonable time to fix the problem before you share it publicly. We suggest [90] days, and we'll agree a date with you.

If you follow these rules, we will treat your research as authorized, we won't pursue legal action, and we will ask others not to. [Counsel to confirm the safe-harbour wording.]

Machine-readable contact details are at /.well-known/security.txt.