Support

What support covers and how to ask

cob-rag-engine is open source under AGPL-3.0 (a commercial licence is available on request). This page says what support means, how to ask, and how to report a security problem. The same promises are in SUPPORT.md and SECURITY.md in the repository.

01What support covers#

Community support runs through GitHub issues, best effort. Commercial support is by contract: https://callobuzz.com/contact.

  • Questions about how a feature works.
  • Bug reports: if the product does not do what the documentation says, open an issue.
  • Updates: every release is free. deploy/upgrade.sh installs it.

Back to top

02What community support does not cover#

  • Installation on your server, and the setup of the server itself. Getting started and the deploy guide are there so you do not need this.
  • Customisation and custom features, and fixing changes you made yourself.
  • Hosting and server administration: your VPS, your domain, your backups.
  • Third-party services and keys, and their costs: AI providers, Meta and WhatsApp, e-mail sending services.
  • Moving data from another system.

Back to top

03How to ask#

Open an issue in the repository. Please include:

  • the version (shown in the dashboard and in CHANGELOG.md);
  • what you did, what happened and what you expected;
  • the last lines of the log, if the server is involved: sudo docker compose --project-directory /opt/cob-rag/current logs --tail 100 app. Remove anything private first.

Back to top

04Response time#

Community support has no promised response time. A security report is acknowledged within 2 business days (Monday to Friday, India time), as section 5 says. Commercial support has the response time you agree by contract.

Back to top

05Security reports#

If you think you found a weakness, e-mail callobuzz@gmail.com with a subject that starts with “SECURITY:”. Please do not post it in public comments. Say what you found, how to see it, and which version.

  • We acknowledge your report within 2 business days.
  • We assess it and tell you how serious we think it is within 5 business days.
  • We aim to fix a critical problem within 14 days, a high one within 30 days, a medium one within 90 days, and a low one in the next release.
  • We tell you when it is fixed, and credit you if you wish.
  • A fix is a new version. The upgrade command installs it.

Since 11 September 2026, the EU Cyber Resilience Act requires us to report a weakness that is being actively exploited to ENISA, the EU’s cybersecurity agency: an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days after a fix is available. We do not have the contact details of everyone who runs the product, so we tell people in two places: the ### Security section of the fixed version’s entry in the CHANGELOG, and a notice on this documentation.

Back to top

06Updates#

Every update, including security fixes, is a new release, and it is free for everyone. Read the CHANGELOG first; it lists what changed and says if anything needs your attention. Then follow Upgrade. The upgrade takes a backup first and can be rolled back.

Back to top