# Report a security issue

Found a vulnerability in Ha Tang, or think your account was misused? How to tell us, what to include and what happens next.

If you find a weakness in Ha Tang, or suspect that someone is misusing an account, tell us privately so we can fix it before it causes harm.

## Report a vulnerability

Email **security@hatang.dev**. Please do not post it publicly, for example in a GitHub issue or on social media, until it is fixed.

Include what you can:

- the part of Ha Tang affected: the dashboard, the API, the chat widget, an app, an SDK or the WordPress plugin;
- the steps to reproduce it;
- the impact you believe it has;
- how we can reach you.

Encrypted email is welcome: ask for our current PGP key in your first message.

## What happens next

- We acknowledge your report within **3 business days** and keep you informed while we work on a fix.
- We ask you to wait **90 days** from our acknowledgement before disclosing it publicly. If a fix is ready sooner, we agree an earlier date with you; if the problem is being exploited, we may publish sooner and tell you first.
- We thank reporters in the release notes, unless you prefer not to be named.

There is no paid bug bounty programme at the moment.

Out of scope: denial of service by sheer volume, findings that need an already compromised device or browser extension, scanner output without a demonstrated impact, and social engineering of Ha Tang staff or customers.

## If you think your account was misused

1. **Remove access you do not recognise.** In **Settings → Employees**, remove anyone who should not be there and revoke unknown **Pending invitations**.
2. **Secure your email.** Ha Tang signs you in with codes sent by email, so change your email password and turn on two-step verification at your email provider.
3. **Replace keys.** Revoke API keys and rotate webhook secrets you are not sure about ([API keys](https://hatang.dev/help/integrations/api-keys), [Webhooks](https://hatang.dev/help/integrations/webhooks)).
4. **Check your channels and bank links.** Reconnect channels or bank connections whose settings changed without your knowledge.
5. **Tell us** at **security@hatang.dev**, with your business name and what you noticed.

## Phishing and fake messages

Ha Tang never asks for your sign-in code, by email, phone, Zalo or chat. A message that asks for it is not from us: do not reply, and forward it to **security@hatang.dev**. Only type a sign-in code on the Ha Tang sign-in page you opened yourself.

For questions about your data rather than a security problem, see [Handle data requests](https://hatang.dev/help/security/data-requests).