Security

Reporting a vulnerability

If you find a security issue in Viably, email [email protected]. Please report it to us privately and give us time to fix it before you tell anyone else. We read every report, including ones that turn out to be low risk.

What to include

• The URL, API endpoint or Slack feature affected.
• Steps to reproduce, with any requests, payloads or screenshots.
• What an attacker could do with it, as far as you know.
• How you would like to be credited, if at all.

What to expect

• We confirm receipt within 3 business days.
• We tell you whether we could reproduce the issue and how we plan to fix it, and we keep you updated until it is resolved.
• We aim to fix critical issues within 30 days and others within 90 days.
• With your permission, we credit you in our changelog once the fix ships.

Scope

These are in scope: viably.app, use.viably.app, bot.viably.app, the Viably Slack app, and the Viably REST API and MCP server.

These are out of scope:

• Denial of service, load testing and spam.
• Social engineering or phishing of our staff or customers.
• Issues in services we depend on, such as Slack, Stripe or Google. Report those to the vendor.
• Scanner output with no demonstrated impact, such as missing headers or version banners.

Safe harbor

We will not take legal action against research done in good faith under this policy. To stay within it:

• Test against a Slack workspace you own, and access no other customer's data beyond the minimum needed to show the issue.
• Delete any data you obtained once you have reported it.
• Avoid anything that degrades the service for other people.
• Keep the details private until we have released a fix.

Bug bounty program

We review each report on its own merits, weighing its severity and the quality of the write-up, and decide on a reward case by case. Every report we accept earns at least:

• A certificate of appreciation from the Viably team.
• Credits added to your Viably workspace, if you have one. Tell us the workspace in your report.

We may offer more for serious findings, but we do not promise a cash payment. A report counts as accepted when we can reproduce it, it falls within the scope above, and nobody reported it before you. For how we store and protect customer data, see our Privacy Policy.