Vulnerability Disclosure Program Policy
Purpose
HeyMax takes the security of its products, services, and customer data seriously. This Vulnerability Disclosure Program (VDP) provides a clear, lawful channel for security researchers and the public to report potential security vulnerabilities affecting HeyMax systems, and explains how we will handle those reports.
Scope — in scope
The program covers HeyMax-owned and -operated systems:
- heymax.ai and its web application and subdomains
- HeyMax mobile apps (iOS and Android)
- HeyMax public APIs and backend services
- Public GitHub repositories under the max-now organization (code and configuration-level issues)
Out of scope
The following are out of scope and must not be tested:
- Systems owned or operated by third parties and partners (e.g., payment processors such as JusPay, banks, card issuers, merchants)
- Physical facilities, social engineering, or phishing of HeyMax staff or users
- Denial-of-service attacks, spam, or mass automated scanning
- Accessing, modifying, or exfiltrating data beyond the minimum needed to demonstrate a vulnerability
Rules of engagement
- Only test in-scope systems, using an account you control wherever possible.
- Keep proof-of-concept to the minimum required to demonstrate the issue; do not access or copy personal data you do not own.
- Do not publicly disclose a vulnerability before we have remediated it (or before our agreed disclosure timeline).
- Report promptly and do not sell, auction, or otherwise commercialize findings.
- If you encounter personal data, stop immediately, do not copy or further process it, and mention it in your report.
Safe harbor
HeyMax will not pursue legal action — including under Singapore's Computer Misuse Act 1993 — or report to law enforcement any researcher who acts in good faith and in line with this policy: testing only in-scope systems, avoiding harm to HeyMax, its users, and third parties, and disclosing findings responsibly. This protection does not extend to activity outside the scope and rules above, and nothing here waives the rights of HeyMax or affected third parties.
How to report
Email security@heymax.ai with:
- A clear description of the vulnerability and the affected asset or URL
- Step-by-step reproduction steps, including proof-of-concept details
- Your assessment of impact and any suggested remediation
If the report involves (or may involve) personal data of HeyMax users, include "[URGENT]" and the words "personal data" in the subject line so we can promptly assess our notification obligations.
Our commitments
- Acknowledgment within 3 business days
- Triage and severity assessment (CVSS-based) within 7 business days
- Remediation as soon as possible — target: Critical/High within 30 days, Medium/Low within 60–90 days, confirmed per case
- Status update at least every 14 days until resolution
- Coordinated public disclosure after the fix is released, or by mutual agreement
Recognition
HeyMax offers recognition and, at our discretion, a monetary reward for qualifying reports. Rewards are assessed case by case based on severity, quality, and impact. Rewards are not guaranteed and may require identity verification and a settlement agreement before payment.
HeyMax has previously paid USD 2,500 for a qualifying disclosure.
Personal data and Singapore compliance
If a report involves personal data, HeyMax will assess it under the Singapore Personal Data Protection Act 2012 (PDPA), including whether it qualifies as a notifiable data breach (significant harm or significant scale). Where required, we will notify the Personal Data Protection Commission (PDPC) no later than 3 calendar days after determining the breach is notifiable and will notify affected individuals as soon as practicable.
Non-qualifying findings
The following typically do not qualify: dependency or CVE listings without demonstrated impact, missing security headers or other hardening recommendations without exploitability, TLS configuration details, phishing or social-engineering scenarios, and issues in third-party services.
Review and ownership
This policy is owned by the Engineering team (tracked in Linear ENG-4138) and will be reviewed at least annually or when our attack surface changes materially. Questions and feedback: security@heymax.ai.
