Session.care

Security

Security Policy & Responsible Disclosure

Last updated: July 26, 2026

Session.care is operated by AI Coalition Network LLC. We take the security of our platform, our customer businesses, and their clients seriously. This page describes how to report a vulnerability, what we commit to in return, and what is in scope.

How to report a vulnerability

If you believe you have found a security vulnerability in Session.care, please report it to us directly before disclosing it publicly. We prefer email:

What to include

  • A clear description of the issue and its potential impact.
  • Steps to reproduce, including any URLs, request payloads, or accounts used.
  • Whether the issue is exploitable against tenant data, platform data, or only the reporter's own account.
  • Your name or handle if you would like credit, or a request to remain anonymous.

Our commitments

When you report a vulnerability in good faith under this policy, we commit to the following:

  • Acknowledgement within 3 business days.
  • Initial assessment within 7 business days, including severity classification.
  • Status updates every 14 days until the issue is resolved or formally closed.
  • Public credit on this page once the issue is fixed, if you wish.
  • Safe harbor: we will not pursue legal action against researchers who follow this policy in good faith. See the safe-harbor section below.

Scope

In scope

  • session.care (marketing site, marketplace, public-facing pages).
  • *.session.care tenant subdomains, provided you only test against tenants you own or have written permission to test.
  • The Session.care REST API (session.care/api/v1/).
  • Authentication and authorization flows, including phone-OTP and email/password login.
  • Multi-tenant isolation: any flaw that allows one tenant to access another tenant's data.
  • Payment integration with PayPal (server-side handling and webhook verification).

Out of scope

  • Denial-of-service, volumetric, or load-testing attacks of any kind.
  • Social engineering of our staff, customers, or their clients.
  • Physical attacks against our infrastructure or staff.
  • Reports from automated scanners without a demonstrated exploit (e.g. "missing header X" with no impact).
  • Vulnerabilities in third-party software we run (Laravel, nginx, PHP, Plesk) that we cannot patch independently — please report those upstream.
  • Issues that require already-compromised credentials, rooted devices, or physical access to a victim's machine.
  • Testing against tenant subdomains belonging to businesses you do not own. Please do not interact with real customer data.

Safe harbor

Research conducted under this policy is considered authorized. Specifically:

  • We will not initiate or refer legal action against you for accidental, good-faith violations of this policy.
  • We waive any restrictions in our Terms of Service that would prohibit security research, for the duration of and to the extent of your testing under this policy.
  • You must make a good-faith effort to avoid privacy violations, data destruction, and service degradation. If you encounter customer data, stop immediately and report it.
  • This safe harbor does not cover actions that violate applicable law independently of our Terms of Service.

Coordinated disclosure timeline

We follow a coordinated disclosure model. Our default request:

  • 90 days from initial report to public disclosure for most issues.
  • Up to 30 additional days by mutual agreement for complex fixes.
  • Earlier disclosure is welcome if the issue is already fixed and you wish to publish a write-up — please coordinate so we can announce in parallel.

What we do not do

  • We do not currently operate a paid bug-bounty program. We may offer thanks, public credit, and at our discretion small tokens of appreciation, but cash rewards are not guaranteed.
  • We do not send unsolicited phishing-style emails. If you receive an email claiming to be from us asking for credentials or payment information, treat it as suspicious and forward it to security@session.care.

Security architecture summary

For transparency, here is a brief overview of the controls we operate:

  • Transport: HTTPS-only via Let's Encrypt; HSTS with one-year max-age and includeSubDomains.
  • Browser protections: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, restrictive Permissions-Policy, and a Content-Security-Policy.
  • Tenant isolation: every tenant-scoped query is enforced through a BelongsToTenant trait and an EnforceTenantScope middleware. Cross-tenant access is blocked at the framework level, not at the controller level.
  • Authentication: Laravel Fortify for web sessions, Sanctum for API tokens. Phone-OTP flow is rate-limited per IP and per phone number.
  • Payments: we do not store full card data. PayPal handles capture; PayPal webhooks are verified by HMAC signature before any booking is confirmed.
  • PII: phone numbers in logs are stored as SHA-256 hashes only. PII is redacted from AI prompts and analytics events at the application layer before egress.

Contact

AI Coalition Network LLC
Operator of Session.care
security@session.care