Report a security vulnerability

If you find a security problem in Gambit, tell us at security@gambit.humanr.ai. We read every report, acknowledge it within two business days and tell you what we will fix and when.

What is in scope

• Gambit and Gambit Mail Sync, the Forge apps for Jira Cloud
• Gambit CRM for Gmail, the inbox add-on (and Gambit CRM for Outlook, for Gambit Beta)
• This website, gambit.humanr.ai, and the sign-in and add-in pages on rainbook.humanr.ai

Atlassian's own products and platform are covered by Atlassian's security programme; report those to Atlassian.

What to include

• The app or page, and what you did, step by step, so we can see what you saw
• What an attacker could reach or change, and on whose site
• Your contact details, if you want us to keep you posted

Please test only on a Jira site you own or are allowed to test, never read or change other people's data, and stop as soon as you reach data that isn't yours. Give us time to fix an issue before you publish it, and we will agree a date with you.

What happens next

1. We acknowledge your report within two business days.
2. We confirm the issue, rate its severity and tell you our plan.
3. We fix it within Atlassian's deadlines for cloud apps: critical within 10 days, high within 4 weeks, medium within 12 weeks and low within 25 weeks.
4. We tell you when the fix is live, and we credit you if you would like.

If the issue affected customer data, we follow our incident response process and tell the customers affected.

What leaves Atlassian

Gambit keeps your records inside Atlassian. The only things it sends outside are usage events to PostHog and error reports to Sentry, which carry no names, email addresses or record content and which your organisation admin can switch off.

Gambit Mail Sync is a separate app that alone talks to Google (and, in Gambit Mail Sync Beta, Microsoft), with read-only mail and calendar permissions, and fetches company logos from logo.dev with only the company's web domain. In a later release it can also reach the services your admin connects with your own account or key, such as Slack, Microsoft Teams, Zapier, Make, Brave Search, Anthropic, OpenAI or Microsoft Azure AI (Azure OpenAI or Azure AI Foundry); nothing is sent to them until then.

The companies that process data for Gambit are on the Subprocessors page.

More about how Gambit protects your data

• Trust centre
• Subprocessors
• Data Handling
• Encryption at Rest
• Architecture of Gambit Mail Sync