Security and Responsible Disclosure

1. Reporting a vulnerability

If you believe you have found a security vulnerability in Manatu, please email support@telluric.solutions with "Security" in the subject. Include:

• the affected address, endpoint, widget or extension version;
• clear steps to reproduce, and what an attacker could achieve;
• any proof of concept, screenshots or logs (remove other people's data);
• how we can reach you, and whether you want to be credited.

We accept reports in English or Hebrew. Our security contact details are also published at https://manatu.contact/.well-known/security.txt.

2. What we promise

• We confirm receipt within 3 business days and keep you updated.
• We aim to fix critical issues within 7 days and others within 90 days.
• We credit you when the fix is released, if you wish.
• If you follow this policy in good faith, we will not take legal action against you for your research, and we consider it authorized.

3. Rules for research

• Only test with accounts and apps you own or have permission to use. Create your own test app; do not use other people's apps or data.
• Do not access, change or delete data that is not yours. If you reach other people's data by accident, stop, do not keep it, and tell us.
• No denial-of-service, load testing, spam, social engineering, phishing, or physical attacks.
• Do not run automated scanners at a volume that degrades the service.
• Give us reasonable time to fix the issue before telling anyone else.

4. Scope

In scope: https://manatu.contact and its subpaths (web app, API, MCP server, widget), and the Manatu Chrome extension.

Out of scope: websites of app owners that embed the widget; third-party services (hosting, Amazon SES, Google); reports without a demonstrated security impact, such as missing best-practice headers alone, clickjacking on pages without sensitive actions, or self-XSS.