Responsible disclosure

How to report

Email hello@aspianalliance.com with "Security report" in the subject. Tell us what you found, how to reproduce it, and what an attacker could do with it. Please do not include real personal data.

In scope

• cloud.aspianalliance.com and its API.
• The Aspian Cloud MCP server and agent keys.
• Approval links, passkey ceremonies and Trust Page share links.
• Ways to read a stored secret value, cross a tenant boundary, approve your own change, or edit the audit trail without detection. These matter most to us.

Out of scope

• Applications our customers deploy. Report those to the customer.
• Denial-of-service testing, spam, social engineering of our staff or customers, and physical attacks on facilities.
• Findings that need a rooted device or an already-compromised browser.

Rules while testing

• Use your own workspace and synthetic data only.
• Stop and report as soon as you can see another tenant’s data. Do not keep, use or share it.
• Give us a reasonable time to fix the issue before telling anyone else; we suggest 90 days.

What we promise

• We acknowledge your report within 3 working days and keep you updated until it is fixed.
• We will not take legal action against research done in good faith under these rules.
• With your permission, we credit you when we publish the fix.