Vulnerability disclosure policy
We want to hear about security problems in Firstview. This policy tells you what you can test, how to report a problem and what we do when you report it.
Last updated: 7 October 2026
Scope
In scope: firstview.ai and its subdomains, the Firstview web app and API, and the Firstview browser extension.
Out of scope: services that our sub-processors run, denial-of-service tests, social engineering of our team or customers, physical attacks, and automated scans that send a large number of requests.
How to report
Email security@firstview.ai. Include the affected URL or component, the steps to reproduce the problem and what an attacker could do with it. You can write in English or Turkish.
Do not send us candidate or customer data that you found. Describe the data instead.
What we do
We reply within 3 business days. We confirm the problem, tell you what we will do about it and tell you when it is fixed.
Give us reasonable time to fix the problem before you make it public.
Safe harbor
If you act in good faith and follow this policy, we will not take legal action against you and we will not ask law enforcement to act against you.
Good faith means that you test only with accounts that you own, you stop and report as soon as you can see data that is not yours, you do not keep, change or share that data, and you do not disrupt the service for other users.
Rewards
We do not run a bug bounty program and we do not pay for reports.
