Responsible disclosure

People trust Aydria with their cases, their calls and their secrets. If you find a weakness, we want to hear about it before anyone else does. Thank you for looking.

How to report

Email security@aydria.com. Our contact details are also in security.txt.

Please include:

• what you found and where (the URL, the app and its version, or the part of the service);
• the steps to reproduce it;
• what an attacker could do with it;
• how we can reach you, and the name you’d like to be credited under.

Keep any personal data you came across out of your report, apart from what’s needed to show the problem.

In scope

• aydria.com, our website;
• app.aydria.com, the web app, and the APIs behind it;
• the desktop apps for Mac, Windows and Linux, in their latest version;
• the voice service, the call server that runs Aydria’s phone calls.

We especially want to hear about anything that:

• lets one user see or change another user’s data, including within a Family plan;
• gets a secret’s value off a user’s device, or into our servers, logs or AI prompts;
• makes Aydria act without the user’s Yes, or spend credits that weren’t approved;
• makes Aydria deny being an AI on a call, or call a number that isn’t a verified business;
• changes a credit balance outside the normal rules.

Out of scope

• social engineering, such as phishing our team or our users;
• physical attacks on our offices, people or devices;
• denial of service, load tests and spam;
• services run by others, like Cloudflare, Supabase, Stripe, Telnyx or WhatsApp. Report those to the company itself;
• automated scanner output without a working example of real impact;
• missing security headers or best practices without a way to exploit them;
• self-XSS and clickjacking on pages without sensitive actions.

The rules

To stay within safe harbour, please:

• test only with accounts you created yourself;
• don’t look at, change or delete other people’s data. If you come across any, stop, don’t keep it, and tell us;
• don’t start real calls, emails or letters to companies or people as part of your testing;
• don’t do more than you need to show the problem, and don’t put our service or our users at risk;
• give us reasonable time to fix the problem before you tell anyone else. We’ll agree a date together, normally within 90 days;
• don’t ask for money in exchange for not publishing.

What we promise

• We reply within 3 working days to confirm we’ve got your report, and keep you posted until it’s fixed.
• No legal action. If you research in good faith and follow these rules, we won’t take legal action against you or report you to the police. If someone else does, we’ll make clear that you acted within our rules.
• Credit, if you want it. Once the problem is fixed, we’ll thank you by name in the hall of fame below. Or not at all, if you’d rather stay anonymous.

We’re a small company and don’t pay bounties yet. We’ll still thank you properly.

Hall of fame

Nobody yet. Be the first.

Changelog

• 1 November 2026: first version.