Vulnerability Disclosure Policy
We welcome reports from security researchers acting in good faith. This policy explains how to report a vulnerability in Apptonomy, what testing is authorized, and what you can expect from us in return.
How to report
Email security@apptonomy.ai with enough detail for us to reproduce and assess the issue. Please include:
- A clear description of the vulnerability and its potential impact.
- Step-by-step instructions to reproduce it, including the affected URL, endpoint, or parameter.
- Any proof-of-concept request, payload, or screenshot needed to demonstrate the issue.
- The date and time of your testing and the source IP address you tested from, so we can correlate it with our logs.
Report one issue per email where practical, and send reports only to the address above — not to product support, sales, or public channels such as social media or GitHub issues.
Handling sensitive information
If your report contains sensitive material — captured credentials, personal data, session tokens, or exploit details — keep it to the minimum needed to prove the issue and tell us in the email that the attachment is sensitive. Do not post it anywhere else. We will treat your report as confidential and will not share your identity publicly without your permission.
Authorized testing
You may, in good faith and only against your own account or test data:
- Probe for and demonstrate common web vulnerabilities against in-scope assets.
- Perform the minimum interaction needed to confirm a vulnerability exists, then stop.
- Test using accounts and data that belong to you.
Out of bounds
The following are not authorized under this policy, and nothing here grants permission for them:
- Accessing, modifying, deleting, or exfiltrating data that is not your own, including other customers' data.
- Denial-of-service, resource-exhaustion, or volumetric/load testing of any kind.
- Social engineering, phishing, or physical attacks against Apptonomy, our staff, or our users.
- Automated scanning at a rate that degrades service, and any attempt to pivot deeper once access is proven.
- Testing third-party services we rely on — report those to the relevant provider.
If you inadvertently encounter another party's data, stop immediately, do not save or share it, and tell us in your report.
Safe harbor
If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you for your research, and we will treat it as authorized. This is not a bug-bounty program: we do not currently offer monetary rewards. We make no representation about the security posture of the platform beyond what is stated on our site, and we make no certification claims we have not earned.
What to expect from us
- We aim to acknowledge your report within five business days.
- We will assess severity, keep you informed of our progress, and let you know when the issue is resolved.
- We are happy to credit reporters who wish to be named once an issue is fixed.
Reports that are spam, purely automated scanner output with no demonstrated impact, or requests for payment in exchange for details may be closed without a detailed response.