Responsible disclosure

Last updated: 21 October 2026

Shimbiri runs software on real boats, so we take security reports seriously. If you think you have found a weakness in shimbiri.ai, the Shimbiri app or any of our boat sites, please tell us.

How to report

Email support@shimbiri.ai. Tell us what you found, where, and the steps to see it again. Screenshots or requests help. Please send one issue per email.

We do not publish a PGP key. If your report holds sensitive detail, say so in your first email and we will agree a safer way for you to send it.

What we commit to

• We will reply within 5 working days to say we have your report.
• We will keep you updated while we look into it and fix it.
• We will tell you when it is fixed, and thank you by name if you would like that.

We do not run a paid bug bounty.

Testing safely

• Only use accounts and boats that are yours, or that you have permission to test.
• Do not read, change or delete other people’s data, and stop as soon as you reach it.
• Never do anything that could affect a boat at sea, its alarms or its instruments.
• No denial of service, spam, social engineering or physical attacks.
• Give us reasonable time to fix an issue before you share it with anyone else.

Safe harbour

If you act in good faith and follow this page, we will not take legal action against you for your research, and we will work with you to understand and fix the problem.