Copycat UI

Security

Report a security vulnerability.

This page documents how to report a suspected vulnerability affecting systems operated by Copycat UI, what responsible research means for this service, and how we handle reports.

Effective date: 5 September 2026

Report a vulnerability Email support@copycatui.com

1. Scope

This process covers the Copycat UI web application at copycatui.com, Copycat UI-hosted APIs, and the Copycat UI Figma plugin and backend integration. It applies only to systems and code operated by New Era Investments (Pty) Ltd. Copycat UI is a product of New Era Investments.

Services operated by Figma, Firebase, Google Cloud, Paystack, Resend, or another provider are outside this scope. Copycat UI cannot authorise research on a third party’s systems or waive that provider’s terms.

2. What to include in a report

Send enough information for us to understand and reproduce the issue without creating additional risk.

  • The affected Copycat UI URL, feature, API endpoint, or plugin workflow.
  • The type of issue and the potential effect on confidentiality, integrity, availability, or user access.
  • Clear, repeatable steps using your own account and data, including any necessary request or response details.
  • A minimal proof of concept, screenshot, or recording with credentials, tokens, personal information, and customer content removed.
  • Whether the issue is already public or has been reported elsewhere, and a safe way to contact you for follow-up.

Do not email passwords, active API keys, Figma connection tokens, payment information, or unredacted personal information. Describe sensitive evidence first so that an appropriate transfer method can be agreed if it is genuinely necessary.

3. Responsible research rules

If a proposed test could fall outside these rules or create risk for users, contact us first and wait for written permission before continuing.

  • Use accounts, projects, workspaces, API keys, Figma files, and content that you own or have explicit permission to test.
  • Keep request volume low and stop if testing could disrupt the service or affect another person.
  • Do not access, modify, retain, or delete another user’s data. If you unexpectedly encounter personal information, credentials, tokens, or customer content, stop testing and report it immediately.
  • Do not use denial-of-service testing, destructive testing, malware, spam, phishing, social engineering, credential stuffing, physical attacks, or broad automated scanning.
  • Do not test Figma, Firebase, Google Cloud, Paystack, Resend, or another third-party service under this policy. Report third-party issues to the relevant provider.
  • Keep the vulnerability confidential until Copycat UI confirms that a fix is available or agrees to a coordinated disclosure plan.

4. How we handle reports

1

Review and acknowledge

We review reports sent to the security contact and aim to acknowledge a complete report as soon as reasonably possible. Timing depends on the report’s clarity, severity, and available investigation resources.

2

Triage and validate

We attempt to reproduce the issue and assess exploitability, affected systems, user impact, and effects on confidentiality, integrity, and availability. We may ask the reporter for additional evidence.

3

Contain and remediate

Verified vulnerabilities are prioritised according to risk. Response may include containment, access or credential changes, a code or configuration fix, dependency updates, additional monitoring, and coordination with an affected service provider.

4

Verify and communicate

We test relevant remediation and provide status updates when reasonably practicable. Public disclosure should be coordinated and should not expose user data, active credentials, or details that would create avoidable risk before remediation.

A vulnerability report is not necessarily evidence of a security compromise. If an investigation confirms a personal-information security compromise, Copycat UI will investigate, mitigate, and make notifications required by applicable law, including POPIA where applicable. See the Privacy Notice.

5. Rewards, recognition, and accreditation

Copycat UI does not currently operate a public bug-bounty programme. A report does not create an entitlement to payment or public recognition.

Copycat UI is not currently certified or accredited under SOC 2, ISO 27001, PCI DSS, HITRUST, SSAE 18, or another comparable security standard. Certifications held by infrastructure or payment providers are not Copycat UI certifications.

6. Changes to this process

We will show a new effective date when this process changes. The reporting address and policy URL are also published in the site’s security.txt file.