Security

Vulnerability Disclosure Policy

FeelFlow Inc. welcomes reports of security issues in the services we operate. This policy sets out the scope, how to report, our response targets, and the conditions under which we protect good-faith researchers.

Scope

This policy covers services on the following hosts that we develop and operate ourselves.

  • feelflow.net — Corporate website
  • id.feelflow.net — FeelFlow ID (shared account platform)
  • strategy.feelflow.net — FeelFlow Strategy
  • chatbot.feelflow.net — FeelFlow Chat
  • hub.feelflow.net — FeelFlow AgentHub
  • board.feelflow.net — FeelFlow Board
  • praxisai.jp — FeelFlow Praxis
  • help.feelflow.net — Help center

Hosts and services not listed are out of scope. If you are unsure whether something is in scope, contact us before you start testing.

How to report

Our reporting address is listed in the Contact field of oursecurity.txt. Please write in Japanese or English and include:

  • The affected host, URL, or feature
  • A description of the issue and its likely impact
  • Steps to reproduce (screenshots or example requests where helpful)
  • How to reach you, and whether you would like to be credited by name

Include only the minimum information needed to demonstrate the issue. Do not send other people's personal data or credentials.

Our response targets

  • Acknowledgement: within 5 business days of receiving your report
  • Initial assessment (whether we can reproduce it, and its severity): within 10 business days of receiving your report
  • After that, we will share our remediation plan and progress

Business days exclude weekends, Japanese public holidays, and the year-end holidays (December 29 to January 3). These are targets, not guarantees, and the time to a fix depends on the severity and scope of the issue.

Guidelines for research

  • Use only accounts and data that you created yourself
  • If you reach anyone else's data or personal information, stop immediately and report it without viewing further, saving, or copying it
  • Do not modify or delete data, or do anything that could take a service down
  • Do not disclose the issue to others until it has been fixed and we have agreed on when to publish

Out of scope

The following are not permitted under this policy:

  • Denial-of-service attacks, high-volume requests, load testing, or anything else that degrades availability
  • Social engineering (including impersonating or phishing our officers, employees, or partners) and physical intrusion
  • Bulk or automated submissions to our contact form or newsletter signup (they send real email)
  • High-volume submissions to features that call external AI services, such as the AI diagnosis
  • Third-party services we use, such as cloud or payment providers (follow each provider's own policy)

Safe harbor

We will not take civil or criminal legal action against you for research and reporting carried out in good faith and in line with this policy. If a third party makes a claim against us concerning your research, we will state that it was conducted in line with this policy.

This policy does not excuse any violation of law, and it does not authorize testing of any third party's services. We cannot guarantee how any third party will act.

Disclosure and credit

Once the issue is fixed, we will agree with you on when and what to publish. With your consent, we will credit you by name when the issue is published.

Rewards

We do not currently run a bug bounty program, and we do not offer monetary or other rewards for reports.

Changes to this policy

We may update this policy as needed.

Established: October 29, 2026
Last updated: October 29, 2026