Security Disclosure Policy
Last updated: August 22, 2021
We take the security of our services seriously and appreciate responsible reports of vulnerabilities that may affect systems operated by Anthony Kung ("we", "us", or "our"). This policy explains how security researchers, customers, and users can report potential vulnerabilities and what we expect from good-faith research activity.
Coordinated vulnerability disclosure helps reduce harm by ensuring that issues can be investigated and, where appropriate, remediated before they are widely exploited. At the same time, security testing must be conducted in a way that respects privacy, avoids unnecessary disruption, and does not create additional risk for other users or systems.
Related documents: Privacy Policy, Terms of Service, and API Usage Policy.
1. How To Report a Vulnerability
Please send vulnerability reports to support@anth.dev. Reports should include enough detail for us to reproduce, validate, and assess the issue efficiently.
Useful information generally includes:
- a clear description of the issue
- the affected product, endpoint, URL, or component
- step-by-step reproduction instructions
- expected impact and severity context
- proof of concept, screenshots, request logs, or other supporting evidence where available
If you are unsure whether an issue is in scope, you may still report it and we will review it.
2. Responsible Research Expectations
We ask security researchers to act in good faith and to minimize the likelihood of harm while validating a report. That means you should avoid accessing, altering, deleting, or retaining data that is not your own except to the minimal extent technically necessary to confirm the issue.
You should not exploit a vulnerability beyond what is reasonably necessary to demonstrate it. You should not pivot to other systems, attempt privilege escalation beyond proof of concept, or engage in destructive testing, spam, social engineering, or denial-of-service activity.
3. Scope
This policy generally covers vulnerabilities affecting websites, APIs, applications, extensions, authentication flows, and infrastructure that we operate as part of the Services.
Examples of issues that may be in scope include:
- authentication or authorization bypass
- material information disclosure
- remote code execution
- injection vulnerabilities
- cross-site scripting with real impact
- significant account takeover risk
- privilege escalation
- logic flaws that undermine meaningful security boundaries
4. Out of Scope
The following categories are generally out of scope unless accompanied by a concrete and material impact:
- purely theoretical issues without a realistic exploit path
- findings that depend on outdated or heavily modified client software
- low-risk misconfigurations without demonstrated security consequence
- clickjacking on non-sensitive pages
- reports based solely on missing headers without exploitability
- social engineering or physical security issues
- denial-of-service or stress testing
Out-of-scope does not necessarily mean unimportant, but it may affect prioritization and whether the issue is handled under this policy.
5. Safe Harbor
If you conduct research in good faith, follow this policy, avoid privacy violations and service disruption, and promptly report the issue to us, we will not pursue legal action solely for the research described in your report.
This safe harbor does not extend to conduct that violates law, compromises unrelated systems, accesses third-party or customer data beyond what is necessary to confirm an issue, or involves extortion, public disclosure before remediation, or destructive behavior.
6. Response Process
We aim to acknowledge valid reports, investigate them, assess impact, and take appropriate remediation steps based on severity, exploitability, product criticality, and available mitigations. Response times may vary depending on the complexity of the issue and operational constraints.
We may request additional information, ask for clarification, or inform you that a reported behavior is not considered a vulnerability under this policy. We may also limit what details we can share about ongoing investigations, internal architecture, or remediation timelines.
7. Contact
Security reports may be sent to support@anth.dev.
