Reporting a vulnerability

How to tell us about a security problem in Sign in with Atheron or any Atheron service, and what we promise in return.

Melden Sie sich an, um Ihre eigene Test-Client-ID in den Beispielen zu sehen.

If you find a security problem in Sign in with Atheron, the developer platform or any Atheron service, tell us first and give us time to fix it.

How to report

Email security@aton-network.org with what you found, how to reproduce it, and what an attacker could do with it. Every developer-facing host also lists this in /.well-known/security.txt.

What we promise

• We reply within two working days, and keep you told until it is fixed.
• We will not take legal action against you, or ask anybody else to, for research done in good faith under this page.
• We credit you here once it is fixed, if you want us to.

What good faith means

• Test only with accounts and apps you own, or with permission from their owner. Use your own test app and testers.
• Do not read, change or keep anybody else's data beyond the least needed to show the problem, and delete it after.
• Do not degrade the service: no denial of service, no high-volume automated scanning, no spam, no social engineering of our staff or members, no physical attacks.
• Do not tell anybody else until we have fixed it, or until 90 days have passed since you told us, whichever comes first.

In scope

accounts.aton-network.org (the OpenID Connect provider), developers.aton-network.org (the portal, the developer API and the MCP server), my.aton-network.org, and the SDKs (atheron-sdk-ts, atheron-sdk-rs).

Thanks

Nobody yet. Be the first.