The full policy
The complete disclosure policy, including safe-harbour terms.
Security
If you have found a vulnerability in Daily+, thank you — please tell us privately before you tell anyone else.
Reporting
Email the security address. Do not open a public issue for a suspected vulnerability. Include what you found, how to reproduce it, the affected endpoint or screen, and the app version and platform.
What we commit to
- Acknowledgement within 3 business days.
- Triage and a severity assessment within 7 business days.
- Critical issues patched as fast as safely possible, targeting 7 days from confirmation; high within 30 days.
- Credit for the reporter, with permission, once a fix ships.
- Safe harbour for good-faith research inside the stated scope.
Scope
In scope: the Daily+ mobile app, the Daily+ API, this website, and their production infrastructure. Out of scope: third-party services we depend on, social engineering, physical attacks, and denial-of-service testing against shared infrastructure. Do not run automated scanners against production without written permission.
security.txt
Machine-readable contact details per RFC 9116, served at the well-known path.