Security & Responsible Disclosure

1. How we protect the service

ChatNow is operated by Skyline Online LLC. The measures below are those in place at the date of this page. They are described in general terms; we do not publish configuration details that would help an attacker.

• Encryption in transit. Every connection to chat-now.uk and to the chat application uses TLS 1.2 or higher; older protocols and weak cipher suites are disabled. HTTP Strict Transport Security (HSTS) instructs browsers never to connect over plain HTTP. Webcam and voice streams use WebRTC, which encrypts media in transit between the browser and our media relay with DTLS-SRTP.
• Password storage. Passwords (minimum 12 characters) are never stored or logged in clear. They are hashed with PBKDF2-SHA512 using a unique per-user salt and a high iteration count. We cannot read your password and never ask for it. Sign-in with Google is available as an alternative; we then receive no password at all.
• Rate limiting and abuse controls. Sign-in, registration, password reset, message sending, uploads and API endpoints are rate-limited per account, IP address and device. Repeated failed sign-ins lock the account temporarily. Each account may hold only one active session at a time; a new sign-in ends the previous one, which limits the damage from a stolen session.
• Access controls and audit logs. Moderation and administration tools are available only to named staff with role-based permissions, protected by strong authentication. Every action in those tools (viewing a report, reading a private message in the context of a report, issuing a sanction, exporting data) is logged with the actor, the time and the reason, and the logs are reviewed. Staff access to personal data is limited to what the task requires.
• Secure development. All input is validated server-side; output is encoded to prevent injection; requests that change state are protected against cross-site request forgery; cookies carrying session state are marked Secure, HttpOnly and SameSite. Third-party dependencies are audited against published vulnerability databases at every build and patched on a defined schedule.
• DDoS and bot protection. Traffic is filtered by Cloudflare, Inc., which absorbs volumetric attacks and presents a bot-protection challenge to suspicious clients before they reach our servers.
• Hosting and backups. The chat platform is hosted by Contabo GmbH and the website by Hetzner Online GmbH, both in Germany (details in the Privacy Policy). Backups are encrypted at rest with keys held separately from the backup storage, kept in Germany, and tested by periodic restore.
• Breach response. We run a written incident-response procedure: containment, assessment of the risk to individuals, notification and remediation. Where a personal-data breach is likely to result in a risk to people's rights and freedoms, we notify the Information Commissioner's Office within 72 hours of becoming aware of it (Article 33 UK GDPR), and we tell affected users without undue delay where the risk is high (Article 34). We keep a record of every breach, notified or not.

2. What we do not store

The most reliable way to protect data is not to hold it. ChatNow never stores:

• Webcam and voice streams. They are relayed in real time through our media servers and are not recorded, buffered to disk or retained in any form.
• Card numbers. ChatNow Premium payments are taken by a PCI-DSS certified payment processor. Card details are entered on the processor's systems; we receive only a transaction reference, amount, currency, plan and date.
• Identity documents, selfies and age estimates. Age checks are performed by AgeVerif under a double-anonymity design. We receive only a yes/no result held for the session; no document, photograph or estimate is ever transmitted to or stored by ChatNow.
• Plain-text passwords (see section 1) and guest content beyond 24 hours after the guest leaves.

3. Responsible disclosure: scope

We welcome reports from security researchers and from ordinary users who notice something wrong. This policy follows the approach recommended by the National Cyber Security Centre's Vulnerability Disclosure Toolkit.

3.1 In scope

• The website at chat-now.uk and all its pages.
• The ChatNow chat application reached from it: rooms, private messages, profiles, uploads, voice notes, webcam signalling, account settings, guest entry and registration, and the interfaces they call.
• Our media relay servers for webcam and voice.

3.2 Out of scope

• Systems operated by third parties: AgeVerif, Cloudflare, Google, OpenAI, Resend, the payment processor, Contabo and Hetzner. Report issues in those systems to the provider concerned; if a third-party issue affects ChatNow users, tell us too so we can mitigate.
• Social engineering of ChatNow staff, moderators or users, including phishing.
• Denial-of-service testing of any kind, including load testing and flooding rooms.
• Spam, mass account creation, or any activity that degrades the service for real users.
• Physical attacks on hosting facilities.
• Reports based only on automated scanner output without a demonstrated impact, missing best-practice headers with no exploit, version disclosure, clickjacking on pages with no sensitive action, and self-XSS.

4. Rules for researchers

Research is covered by this policy only if you follow these rules:

• Use your own accounts. Test with accounts you created for the purpose. Do not access, modify or delete another person's account, messages, images or data. If a vulnerability would let you do so, stop at the point where it is demonstrated.
• No data exfiltration beyond proof. Retrieve the minimum needed to show the issue exists (for example, one record that belongs to your own test account), never bulk data. Delete anything you obtained once the report is acknowledged.
• No privacy violations. Do not read private conversations, view webcam streams or open images you were not meant to see. The people on ChatNow are anonymous for good reasons; their privacy is part of what you are protecting.
• Do no harm. No destructive testing, no persistence, no lateral movement into other systems, no changes to production data or configuration.
• No public disclosure before a fix. Give us the time set out in section 6 to remediate. Once the issue is fixed we are happy for you to publish, and we will agree a date with you. If we miss our own targets without explanation, you may remind us; we ask for 30 days' notice before any publication.
• Stay within UK law and the law of wherever you are located. This policy authorises testing within its terms; it does not authorise anything else.

5. How to report a vulnerability

Email security@chatnow.fr. Please include:

• The affected URL, endpoint or feature.
• Step-by-step instructions to reproduce the issue, with the test account usernames you used, request and response samples, and screenshots or a short recording where helpful.
• Your assessment of the impact: what an attacker could do and to whom.
• Whether you accessed any data that was not yours (see section 4) and confirmation that it has been deleted.
• How you would like to be credited (name, handle or anonymous) and a way to contact you.

Please write in English. Do not include unrelated personal data. You may report anonymously; we will still act on the report, but we will not be able to keep you informed. Reports about content or user behaviour (not security flaws) belong on the Report content or a user page; privacy concerns go to privacy@chatnow.fr.

6. What happens next

Severity is assessed on realistic impact to users, using the Common Vulnerability Scoring System as a guide but not as a rule. If we decide not to fix something (for example because the risk is accepted or the issue is out of scope) we will tell you why.

7. Safe harbour

Skyline Online LLC regards security research carried out in good faith and in accordance with this policy as authorised. For such research we will not report you to law enforcement, will not bring or support a prosecution under the Computer Misuse Act 1990, and will not bring a civil claim against you. If a third party starts legal action against you for research that complied with this policy, we will, on request, confirm to them that your actions were authorised by us.

This safe harbour does not extend to actions outside the rules in section 4, to research that harms users or the service, or to anyone who uses a vulnerability for their own advantage, demands payment in exchange for withholding disclosure, or accesses data beyond what is needed to demonstrate the issue. We cannot authorise conduct that breaches the rights of third parties or the laws of another country.

8. Recognition

We do not run a paid bug bounty and cannot offer monetary rewards. What we offer is honest credit: with your consent, your name or handle is added to a public hall of thanks on this page once the fix is live, with a one-line description of the class of issue and the month it was fixed. Researchers who report several valid issues or one of critical severity are also thanked personally by the Managing Member of Skyline Online LLC.

Duplicate reports are credited to the first person who reported the issue. Out-of-scope findings and scanner output without demonstrated impact are not credited.

8.1 Hall of thanks

No entries yet for the current year. This list is updated as issues are fixed.

9. security.txt

In line with RFC 9116 and the National Cyber Security Centre's recommendation, we publish a machine-readable disclosure file at chat-now.uk/.well-known/security.txt. It contains the contact address above, a link to this policy, the preferred language for reports and an expiry date; we refresh it at least annually and whenever a contact detail changes. If the file has expired, the addresses on this page still apply.

This page is reviewed at least annually. Changes are listed in the Legal Documents Version History. Questions about this policy that are not vulnerability reports can be sent to contact@chatnow.fr.