Report a security issue

If you find a weakness in Ha Tang, or suspect that someone is misusing an account, tell us privately so we can fix it before it causes harm.

Report a vulnerability

Email [email protected]. Please do not post it publicly, for example in a GitHub issue or on social media, until it is fixed.

Include what you can:

• the part of Ha Tang affected: the dashboard, the API, the chat widget, an app, an SDK or the WordPress plugin;
• the steps to reproduce it;
• the impact you believe it has;
• how we can reach you.

Encrypted email is welcome: ask for our current PGP key in your first message.

What happens next

• We acknowledge your report within 3 business days and keep you informed while we work on a fix.
• We ask you to wait 90 days from our acknowledgement before disclosing it publicly. If a fix is ready sooner, we agree an earlier date with you; if the problem is being exploited, we may publish sooner and tell you first.
• We thank reporters in the release notes, unless you prefer not to be named.

There is no paid bug bounty programme at the moment.

Out of scope: denial of service by sheer volume, findings that need an already compromised device or browser extension, scanner output without a demonstrated impact, and social engineering of Ha Tang staff or customers.

If you think your account was misused

1. Remove access you do not recognise. In Settings → Employees, remove anyone who should not be there and revoke unknown Pending invitations.
2. Secure your email. Ha Tang signs you in with codes sent by email, so change your email password and turn on two-step verification at your email provider.
3. Replace keys. Revoke API keys and rotate webhook secrets you are not sure about (API keys, Webhooks).
4. Check your channels and bank links. Reconnect channels or bank connections whose settings changed without your knowledge.
5. Tell us at [email protected], with your business name and what you noticed.

Phishing and fake messages

Ha Tang never asks for your sign-in code, by email, phone, Zalo or chat. A message that asks for it is not from us: do not reply, and forward it to [email protected]. Only type a sign-in code on the Ha Tang sign-in page you opened yourself.

For questions about your data rather than a security problem, see Handle data requests.