QubeHub is the sales platform for real estate developers, and our customers trust it with their buyers, brokers, prices and unsold inventory. We welcome reports from security researchers and users who find a vulnerability in QubeHub, and we ask you to report it to us privately so we can fix it before anyone is harmed.

This policy covers every repository in the qubehub-ai organization and the QubeHub services they describe: qubehub.ai, customer workspaces on qubehub.ai subdomains, the public APIs and embeddable widgets, and the MCP server at mcp.qubehub.ai. How we protect customer data is described at qubehub.ai/security.

Email legal@qubehub.ai with the subject "Security report". Please do not open a public GitHub issue, pull request or discussion for a vulnerability.

A useful report includes:

• the affected URL, endpoint, repository or component;
• the steps to reproduce, with any requests or scripts you used;
• what an attacker could achieve, in your own assessment;
• how we can reach you for follow-up questions.

Do not include other people's personal data in your report. If you came across any while testing, tell us what kind of data it was and delete your copy.

• Test only against accounts and workspaces you own or are explicitly allowed to test.
• Access, change or delete no more data than you need to prove the issue. Once you reach data that belongs to someone else, stop and report.
• Do not run denial-of-service or load tests, and do not degrade the service for other users.
• Do not use social engineering, phishing or physical attacks against our team, our customers or their buyers and agents.
• Do not send messages through customer channels (WhatsApp, Telegram, email and others) to people who have not agreed to take part.
• Keep the details confidential until we have confirmed the issue is fixed and agreed on disclosure with you.

• We aim to confirm that we received your report within a few business days.
• We aim to keep you informed while we investigate and fix the issue, and to tell you when it is resolved.
• If you would like to be credited once the issue is fixed, tell us how you want to be named.

• Findings that require a compromised device, a rooted phone or physical access.
• Denial-of-service, rate-limit exhaustion and volumetric attacks.
• Output of automated scanners without a demonstrated, exploitable impact.
• Vulnerabilities in third-party services we use; please report those to the vendor directly.