---
title: "Security"
url: https://samambai.com/security/
date: 2026-10-06
author: samambai
---

David Reichhardt, founder, leads security at samambai. Report vulnerabilities to security@samambai.com. Reports are acknowledged within 3 business days.

This page names who is responsible for security at samambai, explains how to report a vulnerability, and lists the practices the studio follows on the systems it builds and operates. It is effective from 6 October 2026.

## Who leads security

David Reichhardt, founder of samambai, is the security lead. He is accountable for how the studio reviews, ships and operates the systems it delivers, and for handling security reports and incidents. His background is on [about samambai](/about/).

## How to report a vulnerability

Email [security@samambai.com](mailto:security@samambai.com). Include:

- the affected address, app or system;
- what you found and the steps to reproduce it;
- the impact you expect;
- how to reach you.

English or Portuguese are both fine. The same contact is published in [/.well-known/security.txt](/.well-known/security.txt).

## What is covered

samambai.com, its subdomains, and the products samambai operates. If the problem is in a system the studio built for a client, report it here as well: samambai will coordinate the fix with the client, who owns that system.

## When you test

- Use only accounts and data that are yours.
- Do not run denial-of-service tests, degrade the service, or use social engineering or physical access.
- If you reach data that is not yours, stop and tell us without keeping a copy.
- Give us a reasonable time to fix the problem before you publish it.

## What happens after you report

- You get an acknowledgement within 3 business days.
- You are kept informed until the problem is fixed.
- If you want, you are credited when the fix ships.

## How the studio works

- Significant changes to production systems get an independent adversarial review before release, by AI reviewers separate from whoever built the change.
- Credentials are kept in a password manager.
- Serious production incidents get a written root-cause analysis.

## Company

samambai is the trade name of 19.958.088 DAVID CREIMER REICHHARDT, CNPJ 19.958.088/0001-87, in São Paulo, Brazil.