Responsible vulnerability disclosure

If you think you have found a security issue in skyseat, we want to know. This page explains how to tell us and what to expect from us.

How to contact us

Write to team@skyseat.app. For now it is the only address we use for this; if it changes, we will update it here and in security.txt. You can write to us in English, Spanish or Portuguese.

Please do not send other people's personal data or real credentials in your report: describing the problem and how to reproduce it is enough.

What to include

• What you found and where (address, screen or feature).
• The steps to reproduce it and, if you can, a minimal proof.
• The impact you think it has.
• How you would like to be credited if we mention it (or if you prefer not to be).

What we do when we receive it

• We confirm receipt within 5 business days.
• We review it, tell you whether we consider it a vulnerability and keep you updated on the fix.
• When it is fixed, we let you know. If you wish, we credit you as the finder.
• We will not take legal action against anyone who acts in good faith and follows these rules.

We are a small team: we do not promise fix deadlines, but we will tell you how it is going.

What is in scope

The website skyseat.app and the platform at app.skyseat.app (the dashboard, the API and the AI employees' computers). Third-party services we use are out of scope (see the subprocessors): if the flaw is theirs, please tell them.

Good-faith rules

• Test only with your own accounts. Do not access other people's data beyond the minimum needed to show the flaw, and do not keep or share it.
• No denial-of-service attacks, spam, social engineering or physical testing.
• Do not degrade the service or delete or modify data.
• Give us a reasonable time to fix it before publishing anything.

Rewards

skyseat does not offer rewards or a bug bounty program. We appreciate the report and, if you like, we will credit you publicly.

security.txt

Our security.txt (RFC 9116) carries the contact, this policy and an expiry date. We renew it before it expires.

Last reviewed: November 1, 2026.