Responsible disclosure

Found a security vulnerability? We want to hear about it.

If you report it in good faith and follow the rules below, we will not take legal action against you for the report.

Reporting

Email it@aletaplanet.com.

Please include:

• What you found and why it matters
• Steps to reproduce it, ideally with a proof of concept
• Any Aleta-Request-Id values from requests that show the issue
• Whether you want to be credited

What we commit to

Acknowledge your report	Within 2 business days
Initial assessment	Within 5 business days
Updates while we work	At least every 10 business days
Credit in our advisory	If you want it

Scope

In scope

• API endpoints
• Cockpit Dashboard
• Developer Documentation
• Published SDKs
• Anything that crosses a tenant boundary, exposes cardholder data, or bypasses authentication or authorization

Out of scope

• Denial of service, volumetric testing, or anything that could affect availability for other users
• Social engineering of staff, customers, or cardholders
• Physical attacks
• Automated scanner findings with no demonstrated impact
• Missing security headers with no exploitable consequence
• Software version reports without a working exploit
• Anything that requires a compromised device or someone deliberately acting against their own interests

Rules

1. Use your own sandbox account. Sandbox access is free and self-serve. There is no reason to access someone else's account or data.
2. Don't access, change, or keep data that isn't yours. If you happen to see real cardholder data, stop testing and tell us what happened in your report.
3. Don't disrupt the service. No load testing or production fuzzing.
4. Give us time to fix the issue before making it public. We aim for 90 days, but we'll let you know if something needs more time and why.
5. One issue per report, unless multiple issues need to be chained together for the same attack.

Bug bounty

We don't currently run a paid bug bounty program.

Valid reports will be credited in our security advisory if you want credit, and you'll have our thanks. If we start a paid program in the future, we'll announce it to registered technical contacts.

Reporting a compromised credential

If you think one of your private keys has leaked, don't wait for the disclosure process.

Revoke the client immediately in Cockpit. Revocation takes effect instantly.

Then email it@aletaplanet.com with the client label and whatever you know about the leak.