How do I report a security vulnerability in Chazz.ai?

Email contact@cognitive-industries.org, or read /.well-known/security.txt. Report before exploiting. Good-faith research is not pursued legally and no non-disclosure is required.

Are my conversations encrypted?

Yes. Conversations are encrypted at rest under per-owner keys, and everything is served over TLS with HSTS.

Does Chazz.ai store my card details?

No. Payments are processed by Stripe and card numbers never reach this service.

Security · Chazz.ai

Chazz.ai security: encryption in transit and at rest, per-owner conversation keys, the vulnerability disclosure policy, what is logged, and the specific attacks this product class faces and what is done about them.

Chazz.ai encrypts conversations at rest under per-owner keys, serves everything over TLS with HSTS, screens every turn through a moderation classifier with an auditable record, and accepts vulnerability reports at [email protected]. Report first and do not exploit: good-faith research reported there is not pursued legally, and you will not be asked to stay quiet about it.

Reporting a vulnerability

Email [email protected]. The machine-readable version of this is at /.well-known/security.txt, per RFC 9116.

Good-faith research that follows the above is authorised access under our Terms, and we will say so in writing if anybody ever needs us to. There is no cash bounty. There is a fast reply, credit if you want it, and a fix.

Report before you exploit. Enough to demonstrate the issue, and no further.
Do not access, modify or retain another person's data. If you reach it by accident, stop, say so in the report, and delete what you have.
Do not run denial-of-service tests, automated fuzzers at volume, or social engineering against staff or members.
Give us a reasonable window to fix it before publishing. We will not ask you to stay quiet indefinitely, and we will not ask you to sign anything.

What is in scope

Out of scope: reports generated entirely by a scanner with no demonstrated impact, missing headers with no exploit path, rate limits on unauthenticated endpoints, social engineering, physical attacks, and anything requiring a compromised device belonging to the victim.

chazz.ai and everything it serves.
The API at api.chazz.ai.
The chat-app connectors.

How the service is built

Transport: TLS everywhere, HSTS on every response with a one-year max-age and subdomains included. Plain HTTP is upgraded, never served.
Conversations at rest: Encrypted under per-owner keys. An operator reading the database does not read your chats.
Session replay: Never runs inside a chat. Not sampled, not partial, not "anonymised": it does not run there at all.
Authentication: Single sign-on with short-lived bearer tokens and refresh, over the shared platform identity. Passwords are never held by this application.
Payments: Processed by Stripe. Card numbers do not reach this service and are not stored anywhere in it.
Secrets: Held in the platform secret store and injected at runtime. None are in the client bundle, and a build check fails if application source ships in a source map.
Content isolation: Nothing typed into a conversation can re-author the character, change its instructions, or reach another reader's data. This is the injection surface specific to this product class and it is closed structurally rather than by filtering.

Headers and browser-side protections

Every response carries Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. The enforced Content Security Policy pins base-uri, object-src, frame-ancestors and form-action, which are the four that close injected-base, plugin, clickjacking and credential-exfiltration attacks. The resource allow-list runs in report-only with a live collector while the advertising origins are enumerated from real traffic rather than guessed, which is stated here rather than described as complete.

Abuse and automated traffic

Requests are classified rather than user-agent matched. A known-legitimate crawler is allowed, ordinary traffic is allowed, suspicious traffic is challenged and clearly malicious traffic is blocked, using request shape, path targeting, frequency, reputation and authentication state together. Scanner paths, exploit probes and enumeration attempts are answered without telling the caller anything about what does or does not exist.

Legitimate crawlers, including AI assistants that fetch a page to answer a question, are explicitly welcome. The policy is written out at /for-ai and in robots.txt.

What is logged

The retention windows and your rights over all of it are on the privacy policy.

Request metadata for security and abuse investigation: path, status, timing, country, network and a bot score. Retained for a bounded window.
Moderation decisions, with the score that caused them, so a wrong block can be argued with.
Administrative actions, so operator access to member data is attributable.
Conversation content is not in any of the above.

Where the honest limits are

Operated by Cognitive Industries, ABN 62 794 528 747, Australia.

This is a hosted service run by one operator in one jurisdiction. That is a concentration of trust, and self-hosting is not offered.
It is in early release. Things change, and change is when defects appear.
Encryption at rest protects the database, not the running system. An attacker with live application access is a different threat model, and no page claiming otherwise should be believed.
There is no third-party penetration test to publish yet. When there is, it will be linked here rather than described.

Questions

How do I report a security vulnerability in Chazz.ai?: Email [email protected], or read /.well-known/security.txt. Report before exploiting. Good-faith research is not pursued legally and no non-disclosure is required.
Are my conversations encrypted?: Yes. Conversations are encrypted at rest under per-owner keys, and everything is served over TLS with HSTS.
Does Chazz.ai store my card details?: No. Payments are processed by Stripe and card numbers never reach this service.

Elsewhere on Chazz.ai

This document is the server-rendered form of /security. The interactive page needs JavaScript, and shows the same content.

The complete documentation of this service is available as one plain-text file at /llms-full.txt. A short summary, with the operator's policy for automated readers, is at /llms.txt. Changes are published as a feed at /rss.xml.

Chazz.ai is operated by Cognitive Industries, ABN 62 794 528 747, Australia. Contact: [email protected].