Vulnerability disclosure policy

If you have found a security issue in asynclab.io or in software we publish, we want to hear about it, and we will treat you the way we would want to be treated when we report to others.

How to report

Email hello@asynclab.io with the subject "Security report". Include the affected URL or repository, steps to reproduce, and the impact you believe it has. If you need to send something sensitive, say so first and we will arrange an encrypted channel.

What we promise

• An acknowledgement within two working days, and a first assessment within five.
• A named contact who keeps you informed until the issue is closed.
• Credit, if you want it, once a fix is live.
• No legal action against good-faith research that follows this policy.

Scope

In scope: asynclab.io and its subdomains, and the open-source projects we maintain. Out of scope: our engineers' current employers' systems, which have their own disclosure programmes; third-party services we link to; findings that need physical access or social engineering of a person.

What we ask

• Do not access, modify or delete data that is not yours; demonstrate with your own accounts and the minimum needed to prove the issue.
• No denial of service, no automated scanning at a rate that degrades the service, no spam.
• Give us a reasonable time to fix before publishing; we aim for 90 days at most and will tell you if we need longer.

Machine-readable version: /.well-known/security.txt. Back to the front page.