Report vulnerabilities safely.

1. Reporting a vulnerability

Email support@sawoice.com with the subject “Security report”. Include the affected product and version, reproducible steps, impact, and a safe proof of concept. Use a test account and minimize personal data.

Do not send secrets, access tokens, private audio, transcripts, database exports, or another person's data by ordinary email. Ask for a secure transfer method when sensitive evidence is necessary.

2. Good-faith research

• Avoid privacy violations, service disruption, social engineering, spam, denial of service, physical access, and destructive testing.
• Access only accounts and data you own or are explicitly authorized to test.
• Stop and report if you encounter personal data, credentials, payment data, or a path to material harm.
• Give us reasonable time to investigate and remediate before public disclosure.
• Do not demand payment or threaten disclosure. A bounty is not promised.

Where research follows these rules and applicable law, SAWANT CORE LLP intends to treat it as authorized good-faith testing and work toward a coordinated resolution. This statement cannot authorize conduct against a third party or override law.

3. What to expect

We aim to acknowledge a credible report within three business days, assign severity and an owner, keep the reporter informed at meaningful milestones, and coordinate disclosure after a fix or mitigation. Complex provider, operating-system, or supply-chain issues can require additional time.

4. Supported versions

Security fixes are provided for the latest production website/API deployment and the latest generally available signed desktop release. Users should update promptly. Older desktop builds may be denied cloud/account access where necessary to protect users or infrastructure.

The exact production deployment and supported desktop build numbers are release evidence and must be published with each release; this policy does not invent versions that have not shipped.

5. Security updates and resilience

• Dependency and secret scanning before release.
• CycloneDX software bills of materials for website, API, and desktop artifacts.
• Signed desktop releases and release-provenance checks.
• Content-free security events and time-synchronization monitoring.
• Vulnerability triage, remediation evidence, and Cyber Resilience Act readiness.

6. Security incidents

Incidents are assessed against applicable CERT-In, GDPR/UK GDPR, US/state, Polar, and Cyber Resilience Act duties. We notify regulators, partners, or affected people when legally required and avoid publishing details that would increase active exploitation risk.