Vulnerability Disclosure Policy

How to report

Email support@alterlab.io with the subject prefix "Security:". We acknowledge reports within 3 business days.

Please include:

• The affected URL or endpoint
• Steps to reproduce, with a working proof of concept
• The impact you observed
• Your contact details

In scope

• alterlab.io
• api.alterlab.io
• mcp.alterlab.io

Out of scope and by design

• Open OAuth Dynamic Client Registration (RFC 7591). MCP clients require it; the consent screen marks self-registered apps "Unverified" and shows the redirect URI.
• Rate-limit and volumetric findings.
• Missing security headers without a demonstrated exploit.
• Self-XSS.
• Clickjacking on pages with no state-changing action.
• Reports from automated scanners without a working proof.

Testing rules

• Do not access other users' data.
• Do not run denial-of-service tests.
• Do not use social engineering.
• Test only accounts you own.

Rewards

We do not currently run a paid bug bounty. Good-faith research within these rules will not be pursued.