Responsible Disclosure

• otobiz.ai, the marketing site.
• app.otobiz.ai, the product and its API.
• The MCP server hosts we operate for Otobiz.
• Other domains and third-party services are out of scope.

Email support@otobiz.ai with the affected host or URL, the steps to reproduce, and the impact. Do not include other people's data. We acknowledge a report within 3 business days.

• Test only against accounts you own.
• Do not access, change or delete another customer's data. Stop and report if you reach it.
• No testing that degrades the service: no denial of service, load testing or spam.
• No social engineering of our team or customers, and no physical attacks.
• Give us reasonable time to fix the issue before you disclose it publicly.

If you follow this policy, we treat your research as authorised and will not pursue legal action against you for it.

We do not run a bug bounty. We credit reporters who ask for it once the issue is fixed.