If you believe you've found a security vulnerability in answerLoops — in the hosted service or the self-hosted open-source edition — please report it privately rather than opening a public GitHub issue.

Email security@answerloops.com with:

• A description of the vulnerability and its potential impact
• Steps to reproduce it (proof-of-concept code or requests are welcome)
• The affected component (hosted app, a specific integration, the self-hosted Docker setup, etc.)

• We'll acknowledge your report within 3 business days.
• We'll investigate and let you know whether it's confirmed, and give you an estimated timeline for a fix.
• We'll notify you once a fix has shipped.
• We ask that you give us a reasonable time to fix a confirmed issue before disclosing it publicly.

This policy covers:

• The answerLoops hosted application
• The answerLoops open-source codebase in this repository, including the self-hosted Docker deployment

• Vulnerabilities in third-party services answerLoops integrates with (Discord, Slack, Google Chat, GitHub, Telegram, your AI provider, Stripe, etc.) — please report those directly to the provider.
• Social engineering, physical security, or denial-of-service testing.

Thank you for helping keep answerLoops and its users safe.