Vulnerability Disclosure Policy

Sigbot values the work of independent security researchers in helping keep our customers' data safe. This policy describes what systems and research techniques are covered, how to submit a report, and what you can expect from us in response.

1. Scope

This policy applies to:

• sigbot.co and its subdomains
• The Sigbot API (see our API Terms of Service)

Out of scope

• Third-party services we integrate with but do not operate (e.g. our cloud, email, or payment providers) — please report those directly to the relevant provider.
• Denial-of-service testing, spam, or social engineering against Sigbot staff or customers.
• Automated scanning that generates significant traffic without prior coordination with us.
• Findings that require physical access to a device, or that rely on already-compromised credentials.

2. How to Report

Email security@sigbot.co with:

• A description of the vulnerability and its potential impact;
• Step-by-step instructions to reproduce it, including the URL/endpoint, request, and any proof-of-concept material; and
• Any tools used, so we can distinguish testing traffic from a real attack.

Please do not include actual Customer Data in your report — use test accounts or synthetic data wherever possible. For sensitive reports, you can also use the in-app feedback and report form.

3. What to Expect

We ask that you give us a reasonable opportunity to investigate and remediate an issue before disclosing it publicly, and that you coordinate the timing and content of any public disclosure with us in advance.

4. Recognition

We do not currently run a paid bounty program. We're grateful for every report regardless, and will credit researchers who ask to be credited once an issue is resolved.

5. Contact

security@sigbot.co