Security Policy

Scope

The following assets are in scope for responsible disclosure:

• bidyou.ai — marketing site (Astro static)
• app.bidyou.ai — SaaS application backend & API
• Email infrastructure for *.bidyou.ai and *.crm-line.com
• Code repositories under our direct control

Out of scope

• Denial-of-service (DoS / DDoS) testing of any kind
• Social engineering of our staff, customers, or suppliers
• Physical attacks against offices or hardware
• Automated scanner output without proof-of-concept demonstrating impact
• Vulnerabilities in third-party services we rely on (please report directly: Stripe, Resend, Cloudflare, Anthropic, Webtuga, GitHub)
• Self-XSS, missing security headers without a demonstrated exploit, clickjacking on pages without sensitive actions, non-best-practice TLS configurations without a concrete attack
• Reports requiring victims to install rogue browser extensions or perform unusual actions

What we commit to

• Initial response within 48 hours (business days) acknowledging your report
• Triage within 5 business days with severity assessment
• Resolution targets: critical < 7 days · high < 30 days · medium < 90 days · low best-effort
• Updates at least every 14 days while a report is being worked on
• Credit in our acknowledgements (Hall of Fame) if you wish

What we ask of you

• Give us reasonable time to fix before public disclosure (typically 90 days, negotiable for complex cases)
• Do not access, modify, or delete data that does not belong to you
• Do not deteriorate service quality for our users
• Provide clear, reproducible proof-of-concept
• If you encounter sensitive data accidentally: stop, preserve nothing, contact us immediately

Safe harbour

If you conduct security research in good faith following this policy, we will:

• Not initiate legal action against you
• Work with you to understand and resolve the issue quickly
• Treat your findings as confidential until a fix is available

This commitment extends to good-faith research that incidentally violates the letter of analogous EU/PT/UK statutes (CFAA-like, DMCA-like, Lei do Cibercrime PT n.º 109/2009), provided you act in accordance with this policy.

Bounties

We do not currently operate a paid bounty program. We may, at our discretion, offer rewards (acknowledgement, swag, or monetary) for impactful reports. The primary reward is recognition.

Coordinated disclosure

We are open to coordinated public disclosure of confirmed vulnerabilities once a fix has been deployed. Please coordinate timing via security@crm-line.com.