Security and vulnerability disclosure

We welcome reports of security vulnerabilities in Striker. If you think you've found one, please tell us so we can fix it.

How to report

• Email: security@hoshoai.com
• Machine-readable contact details: /.well-known/security.txt

Please include what you found, where, the steps to reproduce it, and what an attacker could do with it. Write in English if you can.

What's in scope

• The Striker service at https://staging.striker.hoshoai.com, including its public pages, the merchant console, the webhook endpoints and the sign-in and connect flows.

Out of scope: Meta, Instagram, Slack, OpenRouter and the AI hosts, Render, Supabase and other third-party services (report those to them), denial-of-service tests, spam, social engineering of our staff or merchants, and physical attacks.

Please

• Use only accounts you own or test accounts you create yourself.
• Don't access, change or delete other people's data. If you reach personal data or another merchant's data by accident, stop, don't keep a copy, and tell us.
• Don't send messages to real shoppers or real merchants' accounts.
• Give us reasonable time to fix the problem before you tell anyone else.

What we'll do

• Acknowledge your report within 3 working days.
• Tell you within 10 working days what we think and what we plan to do.
• Keep you updated until it's fixed, and credit you if you'd like.

If you follow this policy in good faith, we won't take legal action against you for your research. We don't run a paid bug bounty at the moment.

How we protect data

• Each merchant's data is separated by the database itself (row-level security), not just by application code.
• Access tokens are encrypted before they're stored.
• All connections to Striker use HTTPS, and connections to our database are encrypted.
• Messages from Meta are checked against Meta's signature before we accept them.
• Our dependencies are scanned for known vulnerabilities every week.