Responsible Disclosure

We welcome reports from security researchers. If you find a vulnerability in Niyoos, please tell us privately so we can fix it before anyone is harmed.

1. How to report

Email support@niyoos.com with the subject "Security report". Include:

• what the vulnerability is and where it is (URL, endpoint or component);
• step-by-step instructions to reproduce it;
• the impact you think it has;
• your name or handle, if you would like to be credited.

Please do not include real customer data in your report. If you came across any, tell us what it was and delete it.

2. In scope

• niyoos.com
• app.niyoos.com
• api.niyoos.com (including the proxy)
• Our published connectors and SDKs

3. Out of scope

• Services run by others, including Clerk, Razorpay, Resend, Vercel, Amazon Web Services and AI model providers. Report issues to them directly.
• Denial-of-service or load testing.
• Social engineering, phishing or physical attacks on our staff or premises.
• Spam or brute-forcing of sign-in.
• Reports from automated scanners without a demonstrated, exploitable impact.
• Missing best-practice headers or settings without a demonstrated impact.

4. Rules for testing

• Test only against your own account and workspace. Never access, change or delete data belonging to anyone else.
• Stop as soon as you have confirmed a vulnerability; do not use it to go further.
• Do not degrade the service for other users.
• Give us reasonable time to fix the issue before you tell anyone else. We ask for 90 days, or less once a fix is live.

5. What we promise

• We acknowledge your report within 2 business days.
• We tell you our assessment within 10 business days and keep you updated until it is fixed.
• We credit you publicly when it is fixed, if you want us to.
• If you follow this policy in good faith, we will treat your research as authorised, will not pursue legal action against you for it, and will not report you to law enforcement for it. If someone else brings a claim over research you did in line with this policy, we will make clear that it was authorised.

We do not run a paid bug bounty at present.

6. Thank you

Every report makes Niyoos safer for the businesses that rely on it.