Reporting a security problem.
blip acts for customers at real businesses, so we take reports seriously and thank the people who send them.
How to report
Email mail@diwas.ai with "Security" in the subject. Include what you found, the steps to reproduce it, and what someone could do with it. Please don't put details in a public place until it's fixed.
We'll reply within 3 business days, keep you updated while we work on it, and tell you when it's fixed. We aim to fix serious problems within 30 days. blip doesn't run a paid bounty program at this time.
How to test
- Use the sandbox businesses (search with the word sandbox) and fictional numbers from 555-0100 to 555-0199 with the code 424242. They're fictional, so nobody real is contacted.
- Don't book, order or message real businesses, contact their owners or customers, or use anyone's number but your own or a fictional one.
- Look at only as much data as you need to show the problem, don't keep it, and don't change or delete anyone else's data.
- No denial-of-service or high-volume testing, no flooding of text messages, no social engineering, and no physical attacks.
Safe harbor
If you act in good faith and follow this page, we won't take legal action against you or ask anyone else to, and we'll treat your research as authorized. If something isn't clear, ask us first.
In scope
- blip.diwas.ai and its business subdomains: sign-in, consent and OAuth (customers' and shop owners'), tokens and sessions (MCP, PAP, PACT), owner and admin access, one-tap owner links, and webhooks (Square, DoorDash, Uber, Twilio)
- Anything that lets one customer or business see or change another's data, or act as them
- Signed agent cards and receipts, and Web Bot Auth checks
Out of scope
- Reports from automated scanners without a working example, and missing best-practice headers with no shown impact
- Problems in other companies' services (report those to them), and attacks that need a compromised device
How blip protects data: Privacy. Machine-readable contact: security.txt.