Responsible Disclosure
We welcome reports from security researchers. If you find a vulnerability in AppliFlo, please tell us privately so we can fix it before anyone is harmed.
1. How to report
Email security@appliflo.com with:
- a description of the issue and its impact;
- steps to reproduce it, or a proof of concept; and
- your contact details, if you want us to follow up.
We will acknowledge your report within 3 business days and keep you updated until it is resolved. We aim to fix critical issues within 30 days.
2. Safe harbour
If you act in good faith and follow this policy, we will not take legal action against you or report you to law enforcement for your research. We consider such research authorised. Good faith means you:
- test only against your own account or a test workspace you created;
- access, change or keep no more data than you need to show the issue, and never other customers’ documents;
- do not degrade the Service. No denial-of-service attacks, spam, or high-volume automated scanning;
- do not use social engineering, phishing or physical attacks; and
- give us reasonable time to fix the issue before you disclose it publicly.
3. Scope
In scope: appliflo.com and its subdomains, the AppliFlo web app, signing pages, the REST API and MCP server, and the Chrome extension.
Out of scope: third-party services we use (report those to the vendor); issues that need a compromised device; missing best-practice headers without a demonstrated impact; and rate limits on non-sensitive endpoints.
4. Rewards
We do not run a paid bug bounty yet. We are glad to credit you on this page, with your permission.
5. security.txt
Our contact details are also published at /.well-known/security.txt:
Contact: mailto:security@appliflo.com Expires: 2027-09-09T00:00:00.000Z Preferred-Languages: en Canonical: https://appliflo.com/.well-known/security.txt Policy: https://appliflo.com/responsible-disclosure
6. Hall of thanks
No reports yet. Be the first.
