Reporting a vulnerability

How to tell us about a security problem in Sign in with Atheron or any Atheron service, and what we promise in return.

Inicie sesión para ver su propio ID de cliente de prueba en los ejemplos.

If you find a security problem in Sign in with Atheron, the developer platform or any Atheron service, tell us first and give us time to fix it.

How to report

Email security@aton-network.org with what you found, how to reproduce it, and what an attacker could do with it. Every developer-facing host also lists this in /.well-known/security.txt.

What we promise

• We reply within two working days, and keep you told until it is fixed.
• We will not take legal action against you, or ask anybody else to, for research done in good faith under this page.
• We credit you here once it is fixed, if you want us to.

What good faith means

• Test only with accounts and apps you own, or with permission from their owner. Use your own test app and testers.
• Do not read, change or keep anybody else's data beyond the least needed to show the problem, and delete it after.
• Do not degrade the service: no denial of service, no high-volume automated scanning, no spam, no social engineering of our staff or members, no physical attacks.
• Do not tell anybody else until we have fixed it, or until 90 days have passed since you told us, whichever comes first.

In scope

accounts.aton-network.org (the OpenID Connect provider), developers.aton-network.org (the portal, the developer API and the MCP server), my.aton-network.org, and the SDKs (atheron-sdk-ts, atheron-sdk-rs).

Thanks

Nobody yet. Be the first.