Security

What is in scope

The platform we operate: bunbird.com, app.bunbird.com, mcp.bunbird.com (the connection between AI assistants and Bunbird) and the infrastructure that runs the apps on bunbird.app.

The apps themselves are built by their organisations from their descriptions. A bug in what an app does belongs to the organisation that published it; a way for one app to reach another organisation’s data, or to escape what the platform allows, belongs to us. If you are not sure, write to us anyway.

Rules

Research is welcome as long as you:

• test only against accounts, organisations and apps you created yourself;
• do not read, change or delete other people’s data, and stop and tell us if you come across it;
• do not degrade the service: no denial of service, no automated scanning that slows the platform down, no spam through app notifications;
• do not use social engineering against our people or our users, and no physical attacks;
• do not publish details before we have agreed a date with you;
• follow the law.

How to report

Write to security@bunbird.com, in English or Spanish, with: what you found and where; the steps to reproduce it, with the account or app you used; what an attacker could do with it; and how you want to be credited, if at all.

We confirm receipt within a week and keep you informed while we work on a fix.

What to expect

We treat your report in confidence and do not share your details without your consent. We will not take legal action against research that follows these rules and is done in good faith, and we consider it authorised under our terms. We fix confirmed issues as fast as their severity demands and agree a disclosure date with you once a fix is out. We credit you on request.

Bunbird is in preview, and we do not run a bug bounty programme.

Machine-readable contact

Our contact details for security researchers are also published at bunbird.com/.well-known/security.txt, in the format of RFC 9116.