Security reporting policy

Email hello@helloaida.ai with the subject “Security report”. Include the affected page, approximate time, expected behaviour and minimal reproduction steps using your own test account.

Remove personal information from screenshots. Never email passwords, session cookies, API keys, learner conversations or payment details. If sensitive evidence is essential, first ask us to agree on a secure transfer method.

This policy covers Hello Aida-operated pages and APIs on helloaida.ai and helloaida.co.za, including their www subdomains. It does not authorise testing Replit, payment processors, AI providers, school systems or any other third party.

Use only accounts and data you own or have explicit permission to test. Keep testing minimal and low-volume. Do not access another person’s records, bypass authentication to reach real data, alter privileges, make payments, send bulk messages, upload malicious files, disrupt availability or use social engineering.

If you unexpectedly encounter someone else’s information or a credential, stop immediately. Do not copy, download, alter, retain or share it. Report the location and time without the sensitive content. Do not continue exploiting the issue to prove its impact.

For research conducted in good faith within this policy, Hello Aida authorises the limited testing described above and will not initiate or recommend legal action solely for that compliant research. These scoped permissions take precedence over conflicting inspection or automated-testing restrictions in our Terms.

This commitment does not authorise access to children’s data, override applicable law, bind third parties, or protect deliberately harmful conduct. A report alone does not authorise additional testing.

We will review good-faith reports and coordinate next steps. Please give us a reasonable opportunity to investigate and fix a concern before public disclosure, and discuss disclosure timing with us. No bounty, fixed response deadline or legal certification is promised.