Skip to main content
We welcome reports from security researchers. This policy covers every Synheart product and service, including synheart.ai and its subdomains, the Synheart apps, SDKs and CLI, and Synapse.

How to report

Email security@synheart.ai with:
  • what you found and where (the URL, app version or SDK version);
  • the steps to reproduce it, and what an attacker could do with it;
  • any proof-of-concept code, screenshots or logs.
Please report one issue per email. Encrypted email is not required.

What we commit to

  • We acknowledge your report within 3 business days.
  • We tell you whether we confirm the issue, and keep you updated while we fix it.
  • We credit you when we announce the fix, if you want to be credited.
  • We will not take legal action against you, or ask anyone else to, for research that follows this policy.

Guidelines

  • Test only against accounts and data you own, or have permission to use.
  • Don’t access, change or delete other people’s data. If you reach it by accident, stop, and tell us what you saw.
  • Don’t degrade our services: no denial-of-service, load testing, spam or social engineering of Synheart staff or users.
  • Give us reasonable time to fix the issue before you disclose it publicly. We aim to agree on a date with you.

Out of scope

  • Reports from automated scanners without a demonstrated impact.
  • Missing security headers or best practices with no exploitable effect.
  • Issues in third-party services we don’t control. Report those to the vendor.
  • Physical attacks, and attacks that need a compromised device or account.