Security and vulnerability disclosure

Email [email protected] with "Security" at the front of the subject line. Include what you found, the steps to reproduce it, and what you were able to access. If you have a proof of concept, describe it rather than attaching an executable.

We will acknowledge your report within three business days and tell you whether we can reproduce it. We will let you know when it is fixed. We do not currently run a paid bug bounty, so we cannot promise a reward, and we would rather say that plainly than imply one.

If you make a good faith effort to follow this policy, we will not pursue legal action against you for your research, and we will work with you to understand and fix the issue quickly.

Good faith means: you stop as soon as you have demonstrated the problem, you do not access, modify, or retain data belonging to anyone else, you do not degrade the service for other users, and you give us reasonable time to fix the issue before telling anyone else.

• attribloom.com and the marketing and documentation pages it serves
• api.attribloom.com, including the conversion postback, webhook, and App Store binding endpoints
• The tenant dashboard and the affiliate portal
• Anything that lets one tenant read or change another tenant's data
• Anything that lets an affiliate see data belonging to another affiliate
• Anything that moves money incorrectly: commission, credits, or payouts

• Denial of service, volumetric testing, or anything that degrades the service for real users
• Social engineering of our team, our customers, or our vendors
• Reports from automated scanners with no demonstrated impact
• Missing security headers or weak TLS configuration with no exploitable consequence
• Vulnerabilities in third party services we use, which should be reported to those vendors

Tenant isolation is enforced in the database with Postgres row level security, not only in application code, so a missing check in a route does not by itself expose another tenant's rows.

Passwords are hashed with argon2, and accounts can enable time based two factor authentication. Inbound money events are signature verified: Apple notifications by their JWS chain against a bundled Apple root certificate, Shopify webhooks by HMAC, and generic postbacks by a per surface secret. Tokens are not written to logs.

We are not SOC 2 or ISO 27001 certified and we do not claim to be. If you need a formal attestation for a procurement process, tell us what you need and we will tell you honestly whether we can meet it.