Security

Responsible disclosure.

MYNTHISM takes security seriously. If you find a vulnerability, report it privately. We move fast. We credit good work.

Scope

mynthism.com and all subdomainsIN SCOPE
MYNTHISM API endpointsIN SCOPE
CouncilChat & AI agent infrastructureIN SCOPE
Authentication and session managementIN SCOPE
User data handling and storageIN SCOPE
Third-party services (Stripe, Vercel, Supabase)OUT
Social media accountsOUT
Rate-limiting / DDoS reports without PoCOUT

Disclosure process

STEP 01
Discover

You find a potential security issue. Document the reproduction steps, expected vs actual behavior, and impact.

STEP 02
Report

Email hamdibenjarrar@gmail.com with subject line [SECURITY]. Include full details, screenshots, and PoC if available.

STEP 03
Acknowledge

We confirm receipt within 48 hours and provide an initial assessment within 5 business days.

STEP 04
Resolve

We fix the issue, verify the fix with you if needed, and coordinate the disclosure timeline.

Our pledge to researchers

→We will not pursue legal action against researchers acting in good faith under this policy.
→We acknowledge receipt within 48 hours and provide an initial severity assessment within 5 business days.
→We keep you informed of our progress toward a fix throughout the resolution process.
→We credit you publicly (with your permission) once the vulnerability is resolved.
→We do not share your personal information with third parties without explicit consent.
→We follow coordinated disclosure — we will not publish details before you agree on a timeline.

What we ask of researchers

·Report to us first — give us reasonable time to fix before public disclosure.
·Do not access, modify, or delete user data during testing. Stop as soon as you confirm the vulnerability.
·Do not perform denial of service attacks, spam, or social engineering.
·Provide enough detail to reproduce the issue (steps, screenshots, PoC code).
·Act in good faith — the goal is to protect users, not exploit them.
Report a vulnerability
hamdibenjarrar@gmail.com

Subject: [SECURITY] — We respond within 48 hours.
PGP available on request.