Security

Last updated: 30 September 2026

CommentFor is operated by Neurai Technologies Private Limited. If you have found a security problem in the website, the web app, the phone apps or the API, we want to hear about it, and this page says how we handle a report.

How to report

Write to security@commentfor.com. It is a monitored address, separate from support. The same contact is published in our security.txt file. Please tell us which product is affected, the steps to reproduce the problem, what an attacker could do with it, and any proof of concept. Please do not send live credentials, other people's personal data, or anything you obtained from an account that is not yours.

What we do with a report

• We acknowledge every report within 3 business days.
• We look into it on a best-effort basis and keep you informed of what we find and what we change.
• We credit you for the finding if you want us to, once it is fixed. We do not run a bug bounty and do not pay for reports.

Good-faith research

If you act in good faith, we will not take legal action against you for your research. Good faith means: you do not access, copy or keep data that is not yours, and if you reach someone else's data by accident you stop, keep nothing and tell us; you do not disrupt the service or degrade it for other people; you do not go further into a system than proving the issue requires; and you only test accounts you own. Please stop and report as soon as you have shown the problem.

Disclosure

We ask that you give us 90 days from your report before you publish anything about it. That is a ceiling on disclosure, not a promise of a fix date; we aim to be much faster, and we will tell you where we stand.

Out of scope

• Problems in services we rely on but do not run, such as Instagram and Facebook, Razorpay, Resend, Cloudflare, Apple or Google. Please report those to the provider.
• Social engineering of our staff or customers, physical attacks, and denial of service.
• Findings that need a rooted or jailbroken phone, or a modified copy of the app.
• Reports from automated scanners with no demonstrated impact, such as a missing header on a page that carries no data.

Questions

Anything else about security or personal data goes to privacy@commentfor.com; our Privacy Policy describes what we collect and how we protect it.