Security and responsible disclosure

Your birth details, your chart and your conversations with Esha deserve care. If you find a security weakness in Esha, please tell us so we can fix it quickly.

How to report

Email support@askesha.com with "Security" in the subject line. Please include:

• what you found and where (web address, app screen or API endpoint),
• steps we can follow to see it ourselves,
• what someone could do with it.

We will confirm we have your report within 3 business days and keep you updated until it is fixed.

Please do

• Test only with your own account, or test accounts you created.
• Stop as soon as you have shown the problem, and tell us.
• Give us reasonable time to fix it before you tell anyone else.

Please do not

• Open, change or delete anyone else's data. If you reach someone else's data by accident, stop, do not keep a copy, and tell us.
• Run tests that slow down or break the service, such as flooding, heavy automated scanning or spam.
• Trick, phish or pressure our team or our users.
• Ask for payment in exchange for the details.

Our promise to good-faith researchers

If you follow this policy, we treat your research as authorised. We will not take legal action against you for it, and we will work with you to understand and fix the issue.

Rewards

We do not pay cash rewards for reports. Once a fix is live, we are glad to thank you publicly if you would like that.

Not in scope

• Scanner output without a working example.
• Best-practice suggestions with no real impact on users.
• Problems inside the third-party services we use. Please report those to the provider, unless our setup causes the problem.

Machine-readable contact details are at /.well-known/security.txt.