Security

How to report

Email support@teamyou.ai with “Security report” in the subject. Please include:

• what you found and where (a URL, endpoint or feature);
• the steps to reproduce it;
• what an attacker could do with it;
• how you would like to be credited, if at all.

Please do not put details of an unfixed problem in a public issue, a forum post or a support chat.

What happens next

• We reply to confirm we have your report.
• We look into it and tell you whether we can reproduce it and what we plan to do.
• We keep you updated until it is fixed, and we tell you when it is.
• With your permission, we credit you once the fix is out.

We do not run a paid bug bounty at the moment.

Please

• Look at only as much data as you need to show the problem, and never access, change or delete another person’s data. If you reach someone else’s data by accident, stop and tell us.
• Do not degrade the service for other people: no denial of service, spam or automated scanning at volume.
• Do not try social engineering or phishing on our team or our users.
• Give us a reasonable time to fix the problem before you disclose it publicly.

Before you test

Our Terms of Service do not allow security testing of TeamYou without our written permission. If you want to test something actively, email us first at the same address and tell us what you plan to do. Reporting something you noticed in normal use never needs permission.

For tools

The same contact details are published in machine-readable form at /.well-known/security.txt (RFC 9116).