Vulnerability disclosure policy
Think you have found a security flaw in GetAff? Please tell us before making it public: here is how, what is in scope and what we commit to.
Last updated:
Reporting a vulnerability
Write to security@getaff.org. Describe the issue, the steps to reproduce it, the impact you estimate and, if you can, a proof of concept. English and French are both fine, and so are Spanish and German.
Do not put any third party’s personal data you may have seen in your message: describe it instead.
Scope
In scope: the website www.getaff.org, the public API (/api/v1) and the MCP server (/api/mcp), with the authentication endpoints that serve them (OAuth, API keys).
Out of scope: third-party services we use (Stripe, Google Cloud, Cloudflare…) — report those to their vendor; denial-of-service attacks; social engineering of our team or users; automated scanner reports without a demonstrated impact.
Testing rules
Test only with accounts you own. Do not access, modify or delete other users’ data: stop as soon as the flaw is demonstrated. Do not degrade the service, and do not send request volumes likely to disrupt it.
Give us time to fix the issue before any publication; we will agree on a date with you.
Safe harbour
If you follow this policy, we consider your research authorised: we will not pursue or support legal action against you for it, and if a third party does, we will make it known that you acted in line with this policy.
What we commit to
Acknowledge your report within 5 business days, keep you informed as we handle it, and credit you publicly once it is fixed if you wish. We do not offer financial rewards.