Security Policy

Last updated: 5 June 2026

We take the security of Gianna and the data entrusted to it seriously. This document explains how to report a vulnerability and what to expect in return.

Gianna is a Catholic household assistant reached over Telegram and a web app at gianna.chat. It is proprietary software (see LICENSE); this policy concerns coordinated disclosure of security issues, not any grant of rights to the code.

Reporting a vulnerability

If you believe you have found a security vulnerability, please report it privately. Do not open a public issue, post it publicly, or share it with others before we have had a chance to address it.

Email security@gianna.chat with:

• A clear description of the issue and its potential impact.
• Steps to reproduce, including any proof-of-concept, requests, or payloads.
• The affected component, endpoint, or URL where relevant.
• Your name or handle if you would like to be credited.

If you wish to send sensitive details, ask us in your first message and we will arrange an encrypted channel.

Our commitment

• We aim to acknowledge your report within 3 business days.
• We will give an initial assessment, including severity and likely timeline, within 10 business days.
• We will keep you informed as we work toward a fix and let you know when it is resolved.
• With your permission, we are happy to credit you once the issue is fixed.

Scope

In scope:

• The Gianna web app and API at gianna.chat.
• The Telegram integration.
• Authentication, session handling, billing, and data-access controls.

Out of scope (please do not report or test these):

• Third-party services we rely on — for example Telegram, our LLM provider, Stripe, or PostHog. Report issues in those products to their respective vendors.
• Denial-of-service, volumetric, or brute-force testing.
• Social engineering, phishing, or physical attacks against us, our staff, or our users.
• Reports based solely on automated scanner output without a demonstrated impact.
• Missing security headers or best-practice suggestions with no exploitable impact (still welcome, but treated as informational).

Responsible testing

When investigating, please:

• Only test against your own account and data; never access, modify, or destroy data belonging to other households.
• Stop as soon as you have demonstrated a vulnerability, and do not pivot deeper than necessary to prove impact.
• Avoid privacy violations, service disruption, and any action that could harm users.
• Give us a reasonable opportunity to fix the issue before any public disclosure.

We will not pursue or support legal action against researchers who act in good faith and follow this policy.

How we protect your data

Some of the measures built into Gianna:

• Passwords are hashed with argon2; we never store them in plain text.
• Authenticated access uses signed JWT tokens; the app refuses to boot with a default secret outside fakes mode.
• All traffic is served over TLS.
• Inbound channel messages are sender-verified: the household is resolved from the channel-verified sender identity, never from client-supplied input, preventing cross-household access (no IDOR).
• CORS is locked to the application's own origin in production.
• To avoid silent use of unverified integrations, the app refuses to start in live mode unless its real credentials are properly configured.

For how we collect and handle personal data, see the Privacy Policy. For the terms governing use of the Service, see the Terms of Service.

Contact

Security reports: security@gianna.chat General enquiries: support@gianna.chat