Security Policy

Reporting a vulnerability

Please report suspected vulnerabilities to [email protected]. Do not post security reports publicly.

Helpful reports include the affected product or URL, clear reproduction steps, expected and actual behaviour, impact, and whether any account or data access was involved. We aim to acknowledge valid reports within 3 business days.

Scope

• channl.tv and api.channl.tv.
• channl.tv account, billing, sync, admin, and marketing surfaces.
• channl.tv desktop and mobile applications.
• channl.tv-owned source code and configuration.

Out of scope

• Content, streams, playlists, credentials, or availability controlled by third-party IPTV/VOD providers.
• Social engineering, physical attacks, spam, or denial-of-service testing.
• Automated scanning that materially degrades service.
• Accessing accounts, devices, or data you do not own, except to stop immediately and report the exposure.

Safe harbor

We will not pursue legal action for good-faith research that avoids privacy violations, data destruction, persistence, and service disruption; uses only the minimum access needed to prove the issue; stops testing and reports promptly if another user's data is encountered; and does not publicly disclose details before we have had a reasonable opportunity to remediate.

This safe harbor does not cover extortion, destructive testing, malware, credential stuffing, phishing, or attacks against third-party services.

Other reports

Abuse and takedown reports that are not software vulnerabilities should go to [email protected]. General support requests should go to [email protected].