Security fixes are applied to the current production service and the latest TestFlight build. Older app builds, tags, forks, and self-hosted deployments are not maintained by the HeyTim service unless a separate agreement says otherwise.

Please report suspected vulnerabilities privately to support@heytim.ai.

Include the affected component, reproduction steps, potential impact, and any suggested mitigation. Do not include credentials, private customer information, or exploit data in a public issue.

Do not test against another person’s account or data, use social engineering, degrade production availability, or retain data beyond what is necessary to report the issue. Third-party services such as AWS, Apple, GitHub, and connected providers have their own vulnerability-reporting programs and rules.

The project will acknowledge a report, investigate it, and coordinate a fix and disclosure timeline appropriate to the risk. The source-available license does not authorize access to production systems, customer data, or third-party accounts.