How to report
Send your report to us through the contact form, with the words "Security report" at the start of your message. Please include:
- a description of the issue and why you believe it is a vulnerability;
- the affected address, product or component;
- step-by-step instructions to reproduce it, with any proof-of-concept you have;
- your assessment of the potential impact;
- how you would like to be credited, if at all.
Please do not include personal data belonging to other people in your report.
What you can expect
- An acknowledgment that we have received your report.
- An honest assessment of the issue and, where confirmed, a plan to address it.
- Updates as we make progress.
- Credit for your finding, if you want it, once the issue is resolved.
[Response-time commitments to be confirmed by AFFERENT before publication.] AFFERENT does not currently operate a paid bug bounty program.
Guidelines for researchers
We ask that you:
- make a good-faith effort to avoid privacy violations, data destruction and interruption or degradation of our services;
- access only the minimum data needed to demonstrate the issue, and stop as soon as you encounter personal or confidential information;
- do not use social engineering, physical intrusion or denial-of-service techniques;
- do not test devices or systems installed at a customer site without that customer's explicit permission;
- give us reasonable time to resolve the issue before disclosing it publicly.
Our commitment
If you act in good faith and within this policy, we will regard your research as authorized, will work with you to understand and resolve the issue, and will not pursue legal action against you for it. [Counsel to confirm the safe-harbor language.] This commitment does not extend to conduct outside this policy or to actions affecting third parties.
Scope
In scope: the website at AFFERENT.tech and, as they become available, AFFERENT products and services operated by AFFERENT.
Out of scope: services operated by third parties, reports produced solely by automated scanners without a demonstrated impact, missing best-practice headers without a demonstrated exploit, and issues that require physical access to a user's unlocked device.
Last updated October 7, 2026