Skip to content

Security

Vulnerability disclosure policy

SABR takes the security of our users' data very seriously. If you believe you have found a vulnerability in our marketing site, mobile apps, or backend services, please help us protect our users by following the responsible disclosure process below.

Last updated: July 2026 · Policy version 1.0

1 · Scope

These assets are in scope for security research:

  • get-sabr.com and every sub-domain — marketing site, API endpoints, edge functions
  • The SABR iOS application (App Store)
  • The SABR Android application (Google Play)
  • Our public Supabase project and edge functions

Third-party services we integrate with — Supabase, Stripe, Deepgram, Modal, Vercel, PostHog, Sentry — have their own responsible-disclosure programs. Please report vulnerabilities affecting them directly to those vendors.

2 · Out of scope

  • Denial-of-service attacks or intentional resource exhaustion
  • Social-engineering attempts against SABR staff or users
  • Physical attacks against team members or infrastructure
  • Missing security headers on subresources served by third-party CDNs
  • Reports based purely on software version numbers with no PoC
  • Automated-scanner output without a working proof of concept
  • Rate-limit bypass on public marketing pages (Cloudflare handles that layer)
  • Missing DMARC / SPF / DKIM on non-transactional email domains

3 · How to report

Send an email to support.sabr@gmail.com with the following:

  • A concise description of the issue
  • Steps to reproduce (or a working proof of concept)
  • The URL, endpoint, or app screen affected
  • Impact assessment — what an attacker could achieve
  • Your name or handle if you would like public credit

Please do not publicly disclose the issue until we have had a reasonable chance to investigate, fix it, and roll out a remediation. We will keep you informed at every step.

4 · Our response SLA

  • Acknowledgement within 48 hours of receipt
  • First substantive response within 5 business days
  • Status updates at least every 7 days until closed
  • Fix & coordinated disclosure agreed with you before publication

5 · Safe harbor

Security researchers who follow this policy in good faith will not face legal action from SABR. Specifically:

  • We will not pursue civil or criminal claims against you
  • We will not report you to law enforcement
  • We will not enforce our Terms of Service against your research activity if it stays within scope

Research must be conducted on your own account or a dedicated test account. Never access, modify, or exfiltrate data belonging to other users.

6 · Recognition

We do not currently run a paid bug-bounty program. We do offer public recognition — with your permission — in the release notes once the vulnerability is remediated, and a signed appreciation note for material findings.

7 · Machine-readable policy

This page is referenced from our RFC 9116 security.txt so automated tooling used by security researchers can discover our contact channel automatically.

Questions about this policy? Email us at support.sabr@gmail.com.