Security disclosures

Find a bug. Tell us. Get credit.

AudioPod runs a coordinated-disclosure program for security researchers. Report in good faith and we'll triage fast, fix the issue, and credit you here.

Report a vulnerability

What happens after you report

A four-step process — no black box.

Acknowledge

We confirm receipt of every report within 2 business days.

Triage

We classify severity and confirm reproducibility within 5 business days.

Fix

Standard fix window is 90 days from confirmation, negotiable for high severity.

Credit

Confirmed reporters are added to the hall of fame and credited in release notes.

Scope

What we want eyes on.

In scope

audiopod.ai and all subdomains
AudioPod public API (apiv2.audiopod.ai)
AudioPod mobile clients (when released)
AudioPod MCP server
Account, billing, and credit systems

Out of scope

·Findings from automated scanners without a working proof of concept
·Theoretical vulnerabilities without demonstrated impact
·Issues in third-party infrastructure outside our control (CDN, payment processor, email provider)
·Best-practice recommendations (rate limiting, security headers) without a concrete exploit
·Social engineering of AudioPod staff or customers
·Physical attacks against AudioPod offices or staff
·Spam, phishing, or denial-of-service issues against the production site

Safe harbor

What you can and can't do while testing.

We won't pursue legal action against good-faith researchers who follow these rules.

1Test only against accounts you control.
2Never access, modify, or destroy data belonging to other customers.
3Don't run destructive payloads (data deletion, DoS, integrity corruption).
4Give us a reasonable window to fix before public disclosure — 90 days unless we agree to a shorter window in writing.
5Don't violate any law or breach any agreement to discover or report a vulnerability.

Hall of fame

Researchers who've helped.

No researchers credited yet. Be the first — file a report that lands a confirmed fix and your name (or handle) goes here, with a month-and-year of contribution and a brief description of the class of finding.

File the first report

How to report

One email, plain text, no portal.

Email [email protected] with:

· Title and one-paragraph summary
· Repro steps the team can follow against a test account
· Impact assessment (what could an attacker do)
· Suggested fix, if you have one
· Whether you'd like to be credited, and how (name, handle, link)

Compose report

Security is a team sport.

If you've found something — even something small — we'd rather hear about it than not. We owe the researchers who help us make AudioPod safer for everyone.

Email security