Security at Moss

We take the safety of Moss and the people who use it seriously. What you write in Moss never leaves your phone, but if you find a weakness in the app, this website or anything we run, please tell us.

How to report

• Email support@cyberinnovate.ai with "Security" in the subject, what you found, the steps to reproduce it, and the version of Moss or the page involved.
• Please don't put people's data at risk. Don't access, change or delete data that isn't yours. Don't run denial-of-service or automated scans that degrade the service. Don't use social engineering or physical attacks.
• Give us a reasonable time to fix it (we aim for 90 days) before telling anyone else.

What we promise

• A person replies within three working days.
• We keep you updated while we fix it, and we credit you if you'd like, once it's fixed.
• We won't take legal action against good-faith research that follows this page.

We don't run a paid bug bounty at the moment.

In scope

The Moss apps for iPhone and Android, moss.cyberinnovate.ai, cyberinnovate.ai and its contact API.

Not in scope

Reports from automated scanners without a demonstrated impact, missing best-practice headers with no exploit, and issues in Apple's, Google's or Cloudflare's own services. Please report those to them.