If you believe you have found a security vulnerability in Misterio, please let us know. This policy explains how to report it and what happens next.
How to report
Send your report to [email protected] in English. Please include:
- the affected address or part of the service;
- a description of the vulnerability and its possible impact;
- the steps to reproduce it, with screenshots or a proof of concept where possible.
Scope
This policy covers misterioai.com and its subdomains, including the Misterio platform, its APIs and the chat widget served from our domains.
It does not cover the websites and systems of our customers, including the sites where they embed Misterio and the systems they connect to it, or the services of third parties we use, such as our hosting and AI model providers. Please report vulnerabilities in those to their owners.
Guidelines
When looking for and reporting vulnerabilities, please:
- access no more data than you need to demonstrate the vulnerability, and do not change or delete data;
- stop and report to us at once if you come across personal data or data that belongs to our customers;
- use only accounts that you own or have permission to use;
- do not disrupt the service: no denial-of-service attacks, spam or high-volume automated scanning;
- do not use social engineering or phishing against our staff or customers;
- keep the details confidential and give us reasonable time to fix the vulnerability before disclosing it publicly.
What we do
We acknowledge your report. Our security lead assesses it and, if the vulnerability is confirmed, tracks it until it is fixed. We tell you the outcome.
We do not run a bug bounty program.
This policy is effective from 7th October 2026.