Report a vulnerability

• The affected URL, app or version.
• The steps to reproduce it.
• What an attacker could do with it.
• Any proof of concept you have.

For a bug in the open-source core, you can also open a private report on GitHub.

You must get written permission directly from the withHuman team before you test withhuman.ai, app.withhuman.ai or any other part of the hosted service. Email [email protected] to ask.

Unauthorized testing is not allowed. It breaks our terms.

Once you have permission:

• Use only your own organization and accounts.
• Don't access or change other people's data.
• Don't run denial of service, spam or social engineering.

You can test the self-hosted edition on your own machine without asking.

We confirm we've received your report and keep you updated while we fix it. We agree a disclosure date with you, and credit you in the advisory if you'd like.