Report a security weakness

Report privately

Email security@qalbii.com. Please do not post details in public places, such as social media, public issue trackers or community channels, until we have fixed the problem.

We cannot offer a separate anonymous route yet. If you need to stay anonymous, keep your evidence safe and write to us when you can.

What to include

Give us enough to reproduce and assess the problem, without collecting extra member information.

• The affected page, route, app version or feature.
• Clear steps to reproduce it, what you saw, and the security impact.
• The date and time of your testing, with the time zone.
• Small, cleaned-up screenshots or request details, only where needed.

Please remove secrets

Remove passwords, codes, session cookies, keys, payment details and identity documents from anything you send. If you come across another person's information, stop testing. Do not copy, keep, change or share it.

Research boundaries

This covers systems that Qalbii owns and runs. Other companies' products and systems are out of scope.

• Use only accounts and information you own or have permission to test.
• Keep automated traffic low, and stop if the service may be affected.
• Do not use denial of service, spam, social engineering, physical intrusion or destructive testing.
• Do not change, delete, download or share member information.

Good-faith safe harbour

If your research follows this page, is done in good faith and is reported to us promptly, we will treat it as authorised under anti-hacking law. We will not start legal action only because of that research.

This does not allow unlawful conduct or testing of other companies' systems. If you are unsure whether something is allowed, stop and tell us what you have found first.

After you report

We may ask you questions or ask you to retest safely. Please give us reasonable time to investigate and fix the problem before you tell anyone else. We do not promise a payment or reward unless we agree one with you in writing.