How to reach us
Email legal@airbopti.celarli.com with the subject "Security". Describe the issue, the steps to reproduce it and its possible impact. Our technical contact details are also in /.well-known/security.txt (RFC 9116 format).
What we commit to
- Acknowledge your report within 3 business days.
- Keep you informed while we analyse and fix it.
- Not take legal action against good-faith research that follows the rules below.
- Credit you publicly if you wish, once the issue is fixed.
Scope
- The https://airbopti.celarli.com website and its signed-in application.
- The Airbopti API, MCP server and Chrome extension.
Out of scope: third-party listing sites, our providers (Google, Stripe, Twilio, Mailjet), denial-of-service attacks, social engineering and automated reports without a demonstrated impact.
Rules
- Only access your own test accounts; never view, change or delete other users' data.
- Do not use tools that degrade the service (load tests, mass scans).
- Give us reasonable time to fix the issue (at most 90 days) before publishing anything.