Security
Found a security problem?
Tell us privately and we will fix it fast. Good-faith research is welcome here: we will not take legal action against you, and valid reports are thanked on this page and rewarded with free Pro months.
How to report
- 1
Email us
Write to support@songupai.com with “Security report” in the subject.
- 2
Show us
What is affected, the exact steps or a short video, and what an attacker could do with it.
- 3
Give us time
Keep it private until we confirm it is fixed. We aim to fix serious problems within 30 days.
Scope
In scope
- www.songupai.com and songupai.com, including every page and /api route
- Sign-in and account security: taking over or reading another person’s account
- Payments and plans: getting paid features or songs without paying
- Private songs, prompts, lyrics or uploads that another account can read
- The SongUp AI MCP server (/mcp), ChatGPT app and Claude connector
- The SongUp AI Chrome extension
Out of scope
- Denial of service, load tests, spam and brute force
- Social engineering, phishing and physical attacks on people
- Services we use but do not run (sign-in, payments, hosting), unless the flaw is in how we use them
- Missing headers, cookie flags or TLS settings with no real attack
- Self-XSS, clickjacking on pages with no sensitive action, and logout CSRF
- Reports from automated scanners with no working proof
- Public song pages, public previews and user ids, which are public on purpose
Rules for testing
Follow these and you are covered by our safe-harbour promise.
- Test only with accounts you own. Never read, change or delete other people’s data; stop and tell us as soon as you see any.
- No denial of service, spam, or automated scans that slow the site for others.
- Do not use a flaw to get paid features for real, and do not keep any data you reached.
- Keep the problem private until we have fixed it, then you are welcome to write about it.
- Follow the law where you are. One report per problem; the first valid report of a problem is the one we reward.
Thanks and rewards
Free Pro months on your own SongUp AI account. No cash bounties at the moment.
Critical
12 months of Pro + thanks on this page
For example: Taking over any account, reading all users’ private data.
High
6 months of Pro + thanks on this page
For example: Reading another user’s private songs, getting paid plans free.
Medium
3 months of Pro + thanks on this page
For example: Stored XSS, changing another user’s settings.
Low
Thanks on this page
For example: Small leaks with limited impact.
The level is decided by the SongUp AI team from the real impact on users.
Hall of thanks
Questions
How do I report a security problem in SongUp AI?
Email support@songupai.com with “Security report” in the subject. Say what is affected, the steps to reproduce it and what an attacker could do. Please do not post it publicly until we have fixed it.
Does SongUp AI pay bug bounties?
We thank every valid, new report on this page and give free Pro months for medium, high and critical issues. We do not pay cash bounties at the moment.
Will you take legal action against me for testing?
No, if you follow this policy in good faith: test only your own accounts, stop as soon as you reach other people’s data, do not harm the service, and give us time to fix the problem before telling anyone.
How fast do you reply?
We confirm your report within 3 business days and keep you told until it is fixed.
Not a security problem? For account help write to support@songupai.com; to report a song that copies your work use copyright and content reports. How we handle your data: trust and safety.
Your song on every platform · Pro for $1
Make it today, release it on Spotify, Apple Music, YouTube and TikTok. Commercial license included.
No track to work on? Make one from scratch.
Type an idea or your own lyrics and SongUp AI composes the whole song — music and vocals. Your first one is free.