Security · Responsible disclosure

Found a security issue? Tell us first.

Keeping our customers’ messages, data and accounts safe is central to what we do. If you believe you’ve found a vulnerability in Beep Africa’s services, please report it to us privately so we can fix it quickly.

🔒[email protected]For security reports only. For account help, contact our support team.

How to report

Send your report privately

Email [email protected] with the details below. Please don’t report security issues through social media, public forums or our general support channels.

A clear description of the issue and where you found it (URL, API endpoint or service)
Step-by-step instructions to reproduce it, with screenshots or a short video if possible
The impact you believe it has, and any proof-of-concept code
Your name or handle, if you’d like to be credited

Our commitment to you

What you can expect from us

Quick acknowledgement

We aim to acknowledge your report within 3 business days.

Honest assessment

We’ll investigate, confirm whether the issue is valid and keep you updated.

A timely fix

We prioritise fixes by severity and tell you when the issue is resolved.

Credit where it’s due

With your permission, we’ll thank you publicly once the fix is live.

Rules of engagement

Please test responsibly

Only test against your own account, or accounts you have permission to use
Access, change or delete only the minimum data needed to show the issue, and never other customers’ data or messages
Don’t send messages to numbers or addresses that aren’t yours
Don’t disrupt our services or degrade them for other customers
Give us reasonable time to fix the issue before sharing it publicly. We ask for up to 90 days

Out of scope

Please don’t report or attempt

Denial-of-service or load testing
Social engineering, phishing or physical attacks on our staff or offices
Spam, SMS flooding or sending unsolicited messages
Issues in third-party services we don’t control, including mobile operators
Missing best-practice headers or settings with no demonstrable security impact
Reports from automated scanners without a working proof of concept

Safe harbour

Good-faith research is welcome

If you follow this policy, act in good faith and give us a fair chance to fix the issue, we will not take legal action against you or ask law enforcement to investigate you for your research. If a third party takes action against you over research done in line with this policy, we will make it known that your work was authorised. Valid reports may also qualify for a reward under our bug bounty programme, and we’ll credit you with your permission.

This policy covers beepafrica.com, our customer dashboard, our REST API and SMPP services. It doesn’t give permission to break the law, and it may be updated from time to time.

Talk to a human

Not a security issue?

For help with your account, sender IDs or billing, our support team is available 24/7.