Vulnerability disclosure policy

We welcome reports from security researchers who find problems in Asphaleia systems.

Draft text. To be reviewed by legal counsel before publication.

Scope

This policy covers the Asphaleia website and any systems we operate directly. Client systems are out of scope unless the client has agreed.

What we ask

Please follow these guidelines:

  • Act in good faith and avoid privacy violations or service disruption
  • Do not access, modify or delete data that is not yours
  • Give us reasonable time to fix an issue before sharing details
  • Do not use social engineering or physical attacks

What you can expect

We will acknowledge your report, keep you informed and credit you if you wish once the issue is fixed.

Report a vulnerability

Send details, steps to reproduce and any proof of concept to the security mailbox:

[email protected]

We would like to use Microsoft Clarity to see how visitors use the site, so we can improve it. It sets cookies and is off unless you accept. Cookie policy