Security & Vulnerability Disclosure Policy

1. Scope

This policy applies to vulnerabilities found in any SimbaHost-owned domain or service, including:

• The main website at simbahost.co.ke
• Our customer dashboard at simbahost.co.ke/dashboard
• Our Supabase Edge Functions at *.supabase.co
• Customer-facing APIs and webhooks

Out of scope: third-party services we integrate with (M-Pesa Daraja, our compute provider's API, DirectAdmin on customer accounts, the Tawk.to widget). Please report those to the relevant vendor.

2. How to report

Email security@simbahost.co.ke with:

• A clear description of the vulnerability
• Steps to reproduce, including affected URL / endpoint
• Proof of concept (screenshots or short videos welcome)
• Your name (optional) and how you'd like to be credited

Use PGP if you want to encrypt the report. Our key is published at /.well-known/security.txt.

3. Our commitments

• Acknowledge your report within 48 hours
• Triage and assess severity within 5 business days
• Keep you updated on remediation progress
• Credit you in our hall of fame on this page (if you wish)
• Not take legal action against good-faith reporters who follow this policy

4. Safe harbour

We will not pursue or support criminal investigations against security researchers who:

• Make a good-faith effort to follow this policy
• Do not access data beyond what is needed to demonstrate the vulnerability
• Do not exfiltrate, modify, or destroy data
• Do not disrupt service availability (no DDoS, no rate-limit bypass for stress testing)
• Give us reasonable time to remediate before public disclosure (typically 90 days)

5. Out-of-scope vulnerabilities

• Reports based purely on automated scanner output without manual verification
• Missing security headers without a concrete attack path
• SPF / DKIM / DMARC configuration suggestions (we handle those internally)
• Self-XSS that requires user interaction we wouldn't reasonably encounter
• Clickjacking on pages with no sensitive actions
• CSRF on logout or other non-state-changing endpoints

6. Bug bounty

We do not currently run a paid bug bounty programme, but high-impact reports may receive SimbaHost service credits as a thank-you. We are evaluating a formal bounty programme for 2026/2027, so watch this page for updates.

7. Hall of fame

Researchers who have reported valid vulnerabilities will be listed here (with their consent) once our remediation is verified. The list is currently empty. Be the first.

Questions about this document? Email legal@simbahost.co.ke or contact our support team.