Responsible disclosure: tell us first.

What is in scope

This policy covers the systems we operate ourselves:

• The website: ccxmessages.com, ccxmessages.com.br and ccxmessages.es.
• The dashboard: www.messages.ccxcompany.co.
• The API: api.messages.ccxcompany.co.

Out of scope: third-party services we use (WhatsApp and other Meta products, cloud, email and SMS providers), social engineering, physical attacks, and load or denial-of-service testing.

How to report

Write to security@ccxmessages.com, in Portuguese, English or Spanish.

Include the affected address or route, the steps to reproduce, the impact you were able to demonstrate and how you would like to be contacted. If you need to send something sensitive, say so in your first email and we will agree on a channel.

What we ask

For your research to be in good faith, we ask you to:

• Use only your own accounts and test data. If you reach customer data, stop, do not copy or keep anything, and let us know.
• Do not send WhatsApp, SMS, email or push messages to real people: every message reaches someone and is billed to a customer.
• Do not degrade the service: no denial of service, high-volume scanning or automation that generates load.
• Do not change or delete data that is not yours, and do not keep access after demonstrating the issue.
• Keep the finding confidential until it is fixed, as described under Disclosure.

What we commit to

On our side, we commit to:

• Acknowledge receipt within 5 business days.
• Assess the report and tell you whether we will fix it, with an estimated timeline.
• Keep you posted until the fix.
• Credit you for the finding once it is fixed, if you want. We do not run a paid bounty program.
• Not take legal action against, or file a complaint about, anyone researching in good faith under this policy.

Disclosure

Please make the finding public only after the fix, or 90 days after your report, whichever comes first. If the fix needs more time, we will agree on the date with you.