Security at Opami
Version 2026-09-26
Reporting a vulnerability
Write to security@opami.ai. Tell us what you found, how to reproduce it, and what an attacker could do with it. Plain email is enough; we do not require encryption.
What you can expect
- We acknowledge your report within 3 calendar days.
- We give you a first assessment within 10 calendar days.
- We fix the problem, or give you a dated plan to fix it, within 14 calendar days.
We will reply to you by email and tell you when it is fixed. If you want, we credit you by name.
Safe harbour
We will not pursue legal action, civil or criminal, against a researcher who reports a vulnerability to us in good faith. This applies on four conditions:
- you stay within the scope described below;
- you do not access, modify, exfiltrate or retain other people's data;
- you do not degrade the service;
- you report the issue privately to us before any disclosure.
This protection does not extend to anyone acting in bad faith.
In scope and out of scope
- In scope: opami.ai, www.opami.ai, app.opami.ai, admin.opami.ai, the public API (/api/*) and the MCP server.
- Out of scope: findings against our providers themselves (report those to them), missing security headers with no demonstrated impact, results from automated scanners without a working proof, and social engineering.
No bug bounty
We do not pay for reports today. We say so plainly so that nobody spends a weekend expecting a reward.
If we have an incident
We investigate as soon as we learn of it, contain the problem first, and tell the people affected. Where the law requires it, we notify the Portuguese supervisory authority (CNPD) within 72 hours of becoming aware, and the users affected without undue delay when the risk to them is high. We publish what happened once it is contained. The privacy notice covers how we handle personal data.
Contact
security@opami.ai for security, privacy@opami.ai for data-protection requests, hello@opami.ai for everything else. Controller: Precious Episode LDA, VAT number PT514701617, Portugal.
In case of discrepancy between translations, the English version prevails.