Report a security issue
Email security@haechy.com with what you found and how to reproduce it. We will confirm we got it, keep you updated while we fix it, and credit you if you would like. Please don't access other people's data or disrupt the service while you test.
Last updated: 6 November 2026.
What to send
- The address or host affected, and the account or app you used.
- Steps that reproduce the problem, with any requests or scripts.
- What an attacker could do with it.
- How to reach you, and whether you want to be named.
Plain email is fine. If you'd like to send something sensitive, say so in a first message and we will arrange a way.
In scope
- haechy.com, console.haechy.com and mcp.haechy.com.
- The way Haechy keeps apps on *.haechy.app apart and fenced in: a way out of the sandbox, a way around the approved-services list, a way to open an app without signing in, or a way to read another app's or customer's data.
Out of scope
- Faults inside a customer's own app. Tell that app's owner. If an app is malicious, report it to abuse@haechy.app.
- Denial-of-service, floods of traffic and load testing.
- Social engineering of staff or customers, phishing, and physical attacks.
- Spam, and reports from automated scanners with no demonstrated impact.
- Services we don't run, such as AWS, Twilio, Vercel and Resend, and Claude itself. Report those to the company that runs them.
How to test
- Use your own account and your own apps.
- If you reach data that isn't yours, stop, don't copy or keep it, and tell us.
- Don't run anything that degrades the service for others, and don't send phishing or spam.
- Give us reasonable time to fix a problem before you tell anyone else.
What we will do
- Acknowledge your report as soon as we can, and read it properly.
- Keep you informed about progress and tell you when it is fixed.
- Credit you when we publish a fix, if you would like that.
- Treat your report as confidential until it is fixed.
We don't run a paid bug bounty and can't offer rewards. If you act in good faith and follow the rules above, we will not start legal action against you for research that stays within them. This is a statement of our intent. It can't bind other people and doesn't authorize anything that breaks the law.
More about the controls you may be testing is on the security page, and the rest of our legal information on the trust page. For abuse that isn't a vulnerability, see the acceptable use policy. Our machine-readable contact file is at /.well-known/security.txt.