Security and Vulnerability Disclosure

Security program

ShipMsg uses tenant and environment isolation, least-privilege workload identities, encryption in transit and for protected data at rest, credential sealing, signed webhooks, malware scanning, append-only audit evidence, monitored queues and controllers, dependency review, immutable releases and a database backup before every release. An encrypted backup kept off the production server, with scheduled restore testing, is being introduced and is not yet in place. Controls are risk-based and evolve with the service. No system can guarantee absolute security.

Report a vulnerability

Before you send it: security@shipmsg.com is not receiving mail yet, so a report sent there will not reach anyone. Open a support case from the console, or write to Bagadi LLC at the postal address below, and we will give you a channel for the detail. We would rather tell you that than take a report that silently disappears.

Email security@shipmsg.comwith the affected URL or component, reproduction steps, impact, relevant timestamps and a safe contact method. Do not include live customer data, credentials or destructive payloads. ShipMsg will acknowledge a credible report, investigate, communicate status at reasonable intervals and coordinate remediation and disclosure where appropriate.

Authorized good-faith research

We will not pursue legal action solely for good-faith research that avoids privacy harm, service disruption and unlawful access; uses only accounts and data you own or have written permission to test; stops when sensitive data is encountered; reports promptly; preserves confidentiality while we remediate; and complies with applicable law. This is not authorization to test Meta, Cloudflare, Oracle, Stripe, Twilio or any other third party.

Out of scope

• Denial of service, load testing, spam, social engineering or physical attacks.
• Accessing, modifying, deleting or exfiltrating another customer's data.
• Automated scans that impair service or ignore rate limits.
• Extortion, public disclosure before remediation, or demands for payment.
• Provider issues that do not result from ShipMsg code or configuration.

Customer responsibilities

Customers must protect credentials, enable available MFA, restrict roles, review users and integrations, rotate exposed secrets, validate webhook signatures, maintain secure recipient systems, and notify ShipMsg promptly of suspected compromise. Security summaries may be requested under appropriate confidentiality terms.

Contact

Reaching us today: open a support case from the console, or write to Bagadi LLC at the postal address below. The e-mail addresses named in this document are not yet receiving mail, so a message sent to one will not arrive.

Bagadi LLC operates ShipMsg. Legal questions: legal@shipmsg.com. Privacy questions and rights requests: privacy@shipmsg.com. ShipMsg support questions: support@shipmsg.com. Do not email passwords, payment-card data, message content, or identity documents; ShipMsg will provide a secure verification channel when needed.