Telbox
العربيةGet Telbox
Security

Vulnerability Disclosure Policy

We welcome reports from security researchers. If you've found a vulnerability in Telbox, tell us, we'll work with you in good faith to fix it.

How to report

Email security@telbox.ai. Include:

  • A description of the issue and its impact.
  • Step-by-step reproduction (proof-of-concept, requests, or a short video).
  • The affected surface (iOS app, Android app, api.telbox.ai, the website, or the relay).

Our machine-readable contact lives at /.well-known/security.txt (RFC 9116). If you want to send an encrypted report, ask us for a key in your first message.

What to expect

  • Acknowledgement within 3 business days.
  • Triage & severity assessment within 10 business days.
  • Progress updates until the issue is resolved.
  • Credit in our advisories if you'd like it (tell us how to name you).

Scope

In scope:

  • The Telbox iOS and Android apps.
  • api.telbox.ai and the Telbox backend.
  • telbox.ai and its subdomains.
  • The end-to-end encryption envelope, call transport, and the AI-processing path.

Out of scope (please don't test these):

  • Denial-of-service, volumetric, or rate-limit-exhaustion testing against production.
  • Social engineering, phishing, or physical attacks against Telbox staff or users.
  • Findings from automated scanners with no demonstrated impact.
  • Reports about missing best-practice headers with no exploit path.
  • Third-party services we use (report those to the vendor).

Safe harbor

If you make a good-faith effort to comply with this policy during your research, we will consider your research authorized, we will not pursue or support legal action against you, and we will work with you to understand and resolve the issue quickly. "Good faith" means: only interact with accounts you own or have explicit permission to test, do not access or modify other users' data, do not degrade the service, and give us a reasonable time to remediate before any public disclosure.

Our commitments

  • We do not run a paid bug-bounty program today; this is a coordinated-disclosure policy. We may offer recognition and, at our discretion, swag or a reward for high-impact reports.
  • We aim to remediate valid Critical/High findings promptly and to coordinate a disclosure timeline with you.

This is a coordinated vulnerability disclosure policy, not a legal contract. It is not an offer to indemnify. Questions: security@telbox.ai.