Security & vulnerability disclosure

We welcome reports from security researchers and customers. This page covers how to report a vulnerability in the 4Degrees AI Connector and the 4Degrees Slack app, what is in scope, and what you can expect from us. It supplements the platform-wide security commitments in our master 4Degrees Privacy Policy.

How to report #

Email security@4degrees.ai with a description of the issue, the affected URL or surface, and steps to reproduce. Please do not disclose the issue publicly until we have had a chance to investigate and remediate. We accept reports in English.

Scope #

This disclosure programme covers all 4Degrees production systems, explicitly including:

• The 4Degrees Slack app and its backend (the ai-service hosted at https://sa-mcp.4degrees.ai/mcp) — events, interactions, commands, and options endpoints.
• The 4Degrees AI Connector (MCP server) at https://sa-mcp.4degrees.ai/mcp.
• The 4Degrees web application and API.

Out of scope: findings that require physical access, social engineering of 4Degrees staff, denial-of-service / volumetric testing, and reports against third-party services we use (report those to the respective provider — see our sub-processors).

Our response commitment #

• Acknowledgement of a report within 24 hours.
• Remediation plan within 5 business days for HIGH / CRITICAL severity findings.
• We will keep you updated on progress and let you know when the issue is resolved.

Safe harbor #

We will not pursue legal action against researchers who act in good faith, test only against their own account / a test workspace, avoid privacy violations and service disruption, and give us a reasonable opportunity to remediate before any disclosure. This is a coordinated-disclosure programme; we do not currently operate a paid bug-bounty.

Security posture #

• Transport: TLS 1.2+ on every leg.
• At rest: Slack bot tokens are Fernet-encrypted with a dedicated key; CRM data is encrypted at rest in Cloud SQL with Google-managed keys; email and meeting bodies are encrypted with per-tenant keys and are not readable by the Slack bot.
• Request authenticity: every Slack webhook is HMAC-SHA256 signature-verified (fail-closed) with 5-minute replay protection before any handler runs.
• Identity & authorization: each Slack user links their 4Degrees identity via OAuth and only sees what their 4Degrees permissions allow; writes require explicit per-user opt-in; no destructive operations are exposed.

Contact #

Security reports and questions: security@4degrees.ai.