If you found a security problem in VivaDialog, tell us. Email [email protected] and start the subject with “Security”. We reply within one business day, and we review every report in good faith.
There is no bug bounty program, and we do not pay rewards for reports.
What to include
- The URL or API endpoint involved.
- The steps to reproduce the problem, with the requests and responses if you have them.
- What an attacker could actually do with it, and whose data or account it affects.
A report we can reproduce from the email alone gets a faster, clearer answer.
How to test
- Use only your own account and workspace. Do not access, change, or delete anyone else’s data.
- Do not break anything: no denial-of-service tests, no load or flood testing, and no spam through our forms, the chat widget, or connected channels.
- Do not try to trick our team or our customers, by email, chat, or any other way.
- If you reach personal data that is not yours, stop there, do not keep or share it, and report it to us right away.
Out of scope
We do not treat these as vulnerabilities on their own:
- Output from automated scanners without a working example of real impact.
- Missing security headers or cookie flags without an exploit that uses them.
- Reports about rate limits, such as how many requests an endpoint accepts before it refuses more.
- Email settings such as SPF, DKIM, or DMARC records.
- Open OAuth client registration at
/oauth/register. It is open on purpose, so AI apps from public directories can connect to VivaDialog through MCP.
If you are not sure whether something is in scope, report it anyway and explain the impact.