Vulnerability disclosure policy.

Scope

This policy applies to these systems:

• www.automatum.io, the public website
• app.automatum.io, the product
• docs.automatum.io, the API documentation, and the Automatum API

Systems of other companies are not in scope, even when our product connects to them. Report those problems to the company that operates the system.

How to report

Send an email to hello@automatum.io with the subject “Security report”. Include these items:

• The address or the component that has the problem
• The steps to reproduce the problem
• The effect that you think the problem can have
• Your name and a contact address, if you want a reply

What we ask of you

• Do not read, change, or delete data that is not yours.
• Stop the test when you can show that the problem exists.
• Do not run tests that reduce the service for other users, such as denial-of-service tests.
• Do not use social engineering or physical access against our staff or our offices.
• Give us a reasonable time to correct the problem before you tell other people about it.

What you can expect from us

• We confirm that we received your report in 5 business days.
• We tell you if we accept the report, and we tell you when the problem is corrected.
• We do not start legal action against you if you obey this policy and act in good faith.
• We give you credit for the report, if you want it.

We do not operate a paid bug bounty programme at this time.

Reports that we do not accept

• Results from automatic scanners with no proof that the problem can be used
• Missing security headers or cookie flags with no proof of an effect
• Problems that need physical access to a user’s device
• Spam, social engineering, and denial-of-service reports

More information

See the security page for our controls and documents.