Report a vulnerability

If you believe you have found a security vulnerability in Bella Baxter, email security@bella-baxter.io. A person reads every report.

What to include

• what you found and where (URL, endpoint, CLI or SDK version);
• steps to reproduce;
• the impact you expect.

What happens next

We acknowledge reports within 5 business days. We do not offer a bug bounty.

Good faith research

Test only with accounts and organizations you created. We will not pursue legal action against research done in good faith that avoids accessing or changing other people's data, avoids degrading the service, and gives us reasonable time to fix the issue before disclosure.

Scope

In scope: bella-baxter.io, console.bella-baxter.io, auth.bella-baxter.io, api.bella-baxter.io, docs.bella-baxter.io, and the CLI and SDKs published by Cosmic Chimps. Out of scope: denial-of-service testing, social engineering, and third-party services. Any other host is out of scope, including instances that customers run themselves; if you notice a problem there, tell us but do not test it.