1.How to report
Email security@callfora.com with a description of the issue, the affected URL or API, steps to reproduce, and any proof of concept. Encrypt sensitive details if you can; ask for a key in your first message. Our contact details are also in /.well-known/security.txt.
2.What we promise
- We will acknowledge your report within 3 business days and keep you informed.
- We will not take legal action against, or ask authorities to pursue, researchers who act in good faith under this policy.
- We will fix valid issues as fast as we reasonably can and tell you when they are fixed.
- With your consent, we will credit you for the finding.
3.Rules for researchers
- Test only your own account, or a test workspace you created. Do not access, change, or delete data that is not yours.
- Stop and tell us at once if you reach other customers' data. Do not keep, copy, or share it.
- No denial-of-service, spam, social engineering of our staff or customers, physical attacks, or attacks on our providers' systems.
- Do not make calls or send messages to numbers you do not own through the service.
- Give us reasonable time to fix the issue before you disclose it publicly.
4.Out of scope
Reports about missing security headers with no impact, self-XSS, clickjacking on pages with no sensitive action, reports from automated scanners without a demonstrated issue, and vulnerabilities in third-party services we do not control.
5.Rewards
We do not run a paid bounty program at the moment. We recognise good reports publicly where researchers agree, and we may offer a token of thanks for significant findings.
Need help with this document?
Choose the route that matches your question. These links do not replace the terms above.