Report a security issue

How to report

Send the report to [email protected]. Do not open a public issue and do not post the details on social media. Do not contact other customers.

Include these items in the report:

• The affected domain, app, or API endpoint.
• The steps that reproduce the issue, in order.
• The impact. Explain what an attacker can do and what data they can reach.
• The proof of concept, such as a request, a payload, or a short recording.
• Whether you reached data that belongs to another business or another user.

Scope

These targets are in scope:

• haloai.co.id and its subdomains.
• The Halo AI web application and the Halo AI mobile apps.
• API endpoints that a valid session reaches, and endpoints that need no session.
• Sign-in, session handling, and permission checks.

AI behaviour is also in scope. We want to hear about these findings:

• One business reading the data of another business through the agent.
• Content that makes the agent call a tool with a real side effect, such as a message, a payment, or a data change.
• Disclosure of the system prompt, of tool credentials, or of provider keys.

These findings are out of scope:

• A finding with no demonstrated impact, such as a missing header or a verbose error alone.
• A rate limit that is missing on its own.
• Scanner output with no working proof of concept.
• Social engineering, phishing, physical access, or theft of a device.
• Denial of service by traffic volume.
• Spam, content policy, or trademark issues.
• A vulnerability in a third-party service that we use. Report it to that vendor.

Safe harbour

This protection applies when you meet all of these conditions:

1. You act in good faith and you intend to report the finding.
2. You test only with an account that you own, or with written permission from the account owner.
3. You do not read, change, keep, or share data that belongs to another business or another user.
4. You use the smallest test that proves the finding.
5. You stop the test and email us at once when you reach data that is not yours.
6. You do not lower the availability of the service or damage data.
7. You give us time to fix the issue before you publish it.

What happens next

1. We confirm that we received the report within 2 business days.
2. We assess the report and reply with the result within 5 business days.
3. We keep you informed while we prepare the fix.
4. We tell you when the fix is live.

A complex issue can take longer than 5 business days to fix. We will tell you the plan and the expected date.

Recognition

We do not pay a cash bounty at this time. We credit each researcher by name, with your permission, and we thank you in the reply thread.