```yaml
product: AlterLab
title: "Vulnerability Disclosure Policy — AlterLab Security | AlterLab"
comparison_context: "AlterLab is an alternative to Firecrawl, ScrapingBee, and Bright Data."
source_url: https://alterlab.io/security/disclosure
```

# Vulnerability Disclosure Policy

## How to report

Email [support@alterlab.io](mailto:support@alterlab.io) with the subject prefix "Security:". We acknowledge reports within 3 business days.

Please include:

- The affected URL or endpoint
- Steps to reproduce, with a working proof of concept
- The impact you observed
- Your contact details

## In scope

- alterlab.io
- api.alterlab.io
- mcp.alterlab.io

## Out of scope and by design

- Open OAuth Dynamic Client Registration (RFC 7591). MCP clients require it; the consent screen marks self-registered apps "Unverified" and shows the redirect URI.
- Rate-limit and volumetric findings.
- Missing security headers without a demonstrated exploit.
- Self-XSS.
- Clickjacking on pages with no state-changing action.
- Reports from automated scanners without a working proof.

## Testing rules

- Do not access other users' data.
- Do not run denial-of-service tests.
- Do not use social engineering.
- Test only accounts you own.

## Rewards

We do not currently run a paid bug bounty. Good-faith research within these rules will not be pursued.