Security
If you have found a vulnerability, we want to hear about it, and we would rather hear about it early and informally than not at all.
How to report
Email security@assayerworks.com. Machine-readable contact details are published at /.well-known/security.txt in the format described by RFC 9116.
A useful report contains what you did, what happened, and why it matters. Proof-of-concept code is welcome and never required. If you are unsure whether something counts, send it, deciding that is our job, not yours.
Please do not open a public issue, post details publicly, or file it through a sales or support channel before contacting us.
What to expect
| Acknowledge receipt | within 5 business days |
|---|---|
| Initial assessment | within 15 business days |
| Progress updates | at least every 21 days while open |
| Public credit | on request, once resolved |
Scope
The API and the endpoint agent are listed because they are the surfaces that will matter. Neither is publicly reachable yet, so there is nothing to test on them today: the entries describe intended scope rather than a live target, and we would rather say so than let a scope table imply more surface than exists.
| in scope | |
|---|---|
| assayerworks.com | this site and any subdomain we operate |
| The analysis API | authentication, authorisation, and tenant isolation |
| The endpoint agent | privilege handling, update integrity, local storage |
| Analysis handling | anything that causes submitted files to be exposed, retained beyond policy, or executed |
| out of scope | |
|---|---|
| Volumetric testing | denial of service, load generation, and resource exhaustion |
| Social engineering | against staff, contractors, or infrastructure providers |
| Third-party services | report those to the operator, not to us |
| Findings without impact | missing headers, weak ciphers, or scanner output with no demonstrated consequence |
Safe harbour
If you make a good-faith effort to follow this policy, we will treat your research as authorised, will not pursue or support legal action against you for it, and will work with you if a third party does.
Good faith means: stay within scope, stop as soon as you have confirmed a finding, do not access or retain data belonging to anyone else, do not degrade the service for other people, and give us a reasonable opportunity to fix the issue before publishing.
We do not currently run a paid bounty. We are not going to describe recognition as if it were compensation, if you want public credit, you will get it, and if you would rather stay anonymous that is equally fine.
How submitted files are handled
Anything sent for analysis is treated as potentially sensitive and potentially hostile at the same time. Files are analysed statically by default.
Retention, isolation and deletion terms are being rewritten rather than carried over, so there is deliberately nothing linked here yet. Once they are published, a discrepancy between what they say and what the service does is itself a reportable vulnerability under this policy.