CM Chat logoCM Chat

Trust Center · Disclosure

Found a problem? Tell us. We will listen.

How to report a security issue in CM Chat, what is in scope, what you can expect from us, and the promise we make to people who report in good faith.

Last reviewed October 2026

How to report

Email us.

Send what you found to security@cmchat.app. Our contact details are also published in security.txt.

  1. 1

    Send a first message

    Say what you found and where. Please do not put sensitive data, such as real customer content, in the first message.

  2. 2

    We confirm

    We reply to say we have it, usually within 3 business days.

  3. 3

    We assess

    We reproduce the issue, decide how serious it is and tell you what we found, usually within 10 business days.

  4. 4

    We fix and tell you

    We work on a fix, keep you updated, and tell you when it is released.

Include: the address or app, the steps to reproduce, what you expected and what happened, and your name or handle if you would like credit. If you need a test workspace, ask in your first message.

Scope

What to test, and what to leave alone.

In scope

  • The website at cmchat.app and its public API
  • Workspace addresses under cmchat.app, including the web app, the admin console, file and avatar delivery, and the webhook and email-in routes
  • The CM Chat Android app and the Windows desktop app
  • Sign-in, sessions, passkeys, second steps and invitations
  • Anything that lets one workspace reach another's data, or one user reach what they should not
  • Weaknesses in how customer data is protected

Out of scope

  • Denial of service, flooding and volumetric testing
  • Social engineering or phishing of our staff or customers, and physical attacks
  • Other people's data. Use accounts and workspaces you own, or that we set up for you
  • Third-party services we use (for example Cloudflare or Google). Report those to the provider
  • Automated scanner output with no demonstrated impact, and missing best-practice headers with no exploit
  • Issues that need an already-compromised device or a stolen email account
  • Previously known issues and design choices we have already told you about

Safe harbour

Good faith is protected.

Disclosure
Please give us 90 days to fix an issue before you publish. If we need longer, we will say why. We are happy to agree on a date together.
Rewards
We do not run a paid bounty. We will thank you, and credit you if you want it.

What to expect

Our response targets.

These are targets, not guarantees. A small team runs CM Chat, and we say so.

Response targets
StageTarget
First replyWithin 3 business days
Initial assessment and severityWithin 10 business days
Fix for a critical or high-severity issueAs soon as we can, aiming for 30 days
Fix for other issuesAiming for 90 days
Updates while we workAt least every 2 weeks, on request

Back toTrust Center overview →

Questions from your security team?

Write to hello@cmchat.app and a person will reply. To report a vulnerability, write to security@cmchat.app (see how to report, and security.txt).

Detailed security documentation is available on request: security@cmchat.app.

Schools and districts: talk to us about your district's requirements. We would rather answer a specific question than hand you a badge.