Security & Vulnerability Disclosure
Coffee Chats welcomes good-faith security research that helps us protect our users. This page describes how to report a vulnerability and what to expect from us.
Independent security assessment
Coffee Chats has completed the App Defense Alliance (ADA) Cloud Application Security Assessment (CASA) at Assurance Level 1. CASA is the OWASP ASVS-based assessment Google requires of applications that access restricted Gmail data. Our assessment was performed by TAC Security, a Google-preferred ADA CASA assessor, and approved in September 2026. CASA is renewed annually.
About the CASA program (appdefensealliance.dev)How to report
Email security@coffeechats.me with a description of the issue, the affected hostname or endpoint, steps to reproduce, and your contact information. Encrypt sensitive details if you have our PGP key; we will publish a key here when one is available.
security@coffeechats.meMachine-readable contact details are also published at /.well-known/security.txt on coffeechats.me.
In scope
Production services operated by CSK Venture Holdings Inc. under the coffeechats.me domain, including:
• coffeechats.me (student web application)
• meet.coffeechats.me (booking)
• api.coffeechats.me (API)
• admin.coffeechats.me and tenant subdomains (institution portal)
Out of scope
• Social engineering, phishing, or physical attacks
• Denial-of-service or load testing without prior written approval
• Issues in third-party services we do not operate (Google, Stripe, AI providers, etc.)
• Clickjacking on pages with no sensitive actions
• Missing security headers or TLS configuration already tracked internally
• Reports from automated scanners without a demonstrated exploit
Safe harbor
We intend to work with researchers who follow this policy and act in good faith. We have not published formal safe-harbor language and none is in force. Do not assume legal protection for security testing unless and until counsel-approved text appears here.
What to expect
We aim to acknowledge credible reports within five business days and will keep you informed as we investigate. We practice coordinated disclosure: we will not publish vulnerability details before a fix is deployed unless we agree otherwise with you.
We do not currently operate a paid bug bounty program. We may offer public credit when a reporter agrees and the finding is validated.
Privacy and data handling
Do not access, modify, or exfiltrate user data beyond what is necessary to demonstrate a vulnerability. Use test accounts you control. If you accidentally encounter real user data, stop, report it, and delete local copies.
Other contacts
Privacy questions: privacy@coffeechats.me. Accessibility barriers: accessibility@coffeechats.me. Both addresses reach the Coffee Chats team.