Security and vulnerability disclosure

If you believe you have found a security vulnerability in Connie, email support@connie.ai with "Security" in the subject line. Please include:

• what the issue is and where it is, such as the URL, feature or API endpoint;
• the steps to reproduce it;
• the impact you believe it has.

Please don't include anyone else's personal data in your report.

• The Connie web app at https://connie.ai and its API.
• The Connie app for Slack: installing it, connecting it, and what Connie reads and does in Slack.
• The Connie MCP server and its sign-in for AI assistants.
• Connie's connections to other services, where the issue is in Connie's own code.

• Denial-of-service attacks and load testing.
• Social engineering, phishing and physical attacks.
• Vulnerabilities in third-party services, such as Slack or Google. Please report those to the service itself.
• Automated scanner output without a demonstrated security impact.

• Only test with accounts and workspaces you own or have permission to use.
• Don't access, change or delete data that isn't yours. If you come across someone else's data, stop and tell us.
• Don't degrade the service for other customers.
• Give us reasonable time to fix the issue before you disclose it publicly.

We read every report, confirm we have received it, keep you updated while we investigate, and tell you when the issue is fixed. If you follow this policy, we treat your research as authorized and won't take legal action against you for it.

We don't run a paid bug bounty program.

For how Connie collects, uses and protects your data, see the Privacy Policy.