Security and responsible disclosure
Report a vulnerability
If you find a security problem, email support@safemeai.in with the steps to reproduce it. Please give us reasonable time to fix it before sharing it publicly. Our contact details are also in security.txt.
Please do
- Test only with your own data and accounts.
- Stop and tell us if you reach another person's data.
- Keep your testing light: no denial-of-service or automated mass scanning.
What we do to protect you
- HTTPS everywhere, with strict browser security headers (no inline scripts, no framing).
- Text you check is processed in India (Google Cloud Mumbai) and is not stored. Personal data is masked before it is sent to an AI model.
- Every API request gets a request ID, and a private audit log records a hash of the input, never the message itself.
- Rate limits protect the service from abuse. Admin and scheduler routes are not reachable from the public site.
- Crowd reports are anonymised, and a genuine bank or government site can never be blocked automatically by false reports.