Trust center
Vulnerability disclosure policy
If you have found a security issue, we want to hear about it and we will treat you as a colleague, not a threat. No bounty program is funded today; we say so rather than imply one.
What we commit to
- Acknowledge your report within three working days.
- Keep you informed of progress, and tell you when the issue is fixed.
- Not pursue legal action against good-faith research that follows this policy.
- Credit you, if you wish, once the issue is resolved.
What we ask
- Do not access, modify or delete data that is not yours; test only with an account that is yours, never a real participant’s.
- Do not degrade the service (no denial of service, no automated scanning at volume).
- Do not disclose publicly before we have had a reasonable time to fix: ninety days is the default, agreed case by case.
- Report through the security contact in /.well-known/security.txt, in English or Kiswahili.
Scope
This site and its portal. The platform behind partner deployments has its own contacts under each program’s terms. The security contact, policy link and expiry are published machine-readably at /.well-known/security.txt.
Back to the trust center.