> For the complete documentation index, see [llms.txt](https://policies.appfarm.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://policies.appfarm.io/security/responsible-disclosure-policy.md). # Responsible Disclosure Policy This web page sets out the terms and conditions applicable to all individuals who intend to research information security vulnerabilities affecting Appfarm AS's assets. ### Safe harbour If you conduct security research in good faith and within the terms of this policy, we consider that research authorized. We will not treat it as a breach of our terms of service, will not initiate legal action against you, and will not report you to the authorities. If a third party brings any action against you over research you carried out under this policy, we will confirm to them that it was authorized. This covers research that stays inside the policy. Testing that is destructive or ill-intentioned, deliberately attacks a specific customer's solution or anyone else's data, continues after we have asked you to stop, or breaks the sandbox restriction under section Scope, is outside it. We can only speak for Appfarm. Where our services depend on third parties, their terms govern how you interact with them. If you are unsure whether something is in bounds, ask us at before you test it. ### The Submission Process If you believe you have found any vulnerabilities in assets within the scope, you can submit a thorough report to . **Send one report per email.** If you find several unrelated issues, send each one in its own email rather than as a reply in an existing thread. Each report is then tracked and addressed individually. We acknowledge receipt within 5 business days and aim to provide a substantive response within 10 business days. Where a report is critical, we acknowledge it within 24 hours. Complex reports take longer to assess, and we will tell you if we need more time. Reports covered by the not-wanted list under Triage are the exception and may receive no reply. ### Triage We're always interested in hearing about any reproducible vulnerability that affects the security of users, including: * Remote Code Execution (RCE) * SQL Injection (SQLi) * Server Side Request Forgery (SSRF) * Cross-Site Request Forgery (CSRF) * Cross-Site Scripting (XSS) We are generally not interested in reports pointing out the following issues: * HTTP sniffing or HTTP tampering exploits * Open API endpoints serving public data * Brute force, DoS, DDoS, phishing, text injection, or social engineering attacks. * Output from automated scans * Clickjacking with minimal security implications * Missing DMARC records or other email headers * Missing CAA * URL Injection with minimal security impact. * Missing webpage headers * Missing rate-limiter * Content Spoofing with minimal impact or relevance Reports containing findings on our not-wanted list may be closed without further correspondence. ### Scope Appfarm runs on two domains, and they are not the same thing: * **appfarm.io** and **\*.appfarm.io**: our website, the Appfarm platform itself, and our APIs. * **appfarm.app**: the solutions built on the platform, one address per solution environment. Most of them belong to our customers. You may test: * appfarm.io and \*.appfarm.io. * On appfarm.app, **only an environment you created yourself** through our self-sign-up sandbox. When testing the sandbox service, researchers are limited to signing up and activating only one environment. Researchers disregarding this restriction will be disqualified. You may not test: * **Any solution on appfarm.app that you do not own.** Those environments belong to our customers and hold their data. Testing one is outside this policy and outside the safe harbor above, whatever the intent, and it will disqualify you from a reward. If you believe you have seen a problem in a customer's solution, tell us and stop there. You do not need to prove it to us. * Anyone else's account, data, or environment on any of our domains. What we can do about a report depends on who operates the affected asset: * **The Appfarm platform and the services we run ourselves**, including the solutions Appfarm builds and operates. Handled under this policy. * **How a customer has configured their own solution**, and the data in it, are the customer's. We will pass such a report on to them, and it is not eligible for a reward from us. If you believe the platform itself is at fault rather than the configuration, say so, and we will assess it under this policy. * **Sub-processors and other third parties.** Any potential problems with our sub-processors will be forwarded to the responsible party for evaluation. ### Coordinated disclosure If you intend to publish your findings, we ask that you wait until 90 days after your initial report or 30 days after we have confirmed a fix is live, whichever is later. Tell us if you plan to publish, and we will work with you on timing. A disclosure window covers the agreed-upon report. If you have sent us more than one report, each has its own. ### Reward We consider rewards on a case-by-case basis. Any reward is at our discretion and is decided after we have received and validated a report. We do not publish set prices, and a valid report does not guarantee a reward. Our intention is to offer rewards when the case warrants it. Reports that are out of scope, duplicates of issues we already know about, or generated by automated scanning without demonstrated impact are not eligible, nor is research that violates the conditions under Scope. ### Acknowledgements We are happy to credit researchers publicly for findings we accept, if they would like that. Credit is optional and is offered when a report is resolved. You choose the name or handle we publish, and we publish nothing beyond it and the month. Being listed depends on a valid finding, not on whether a reward was paid. Ask us to remove your entry at any time and we will, without question. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://policies.appfarm.io/security/responsible-disclosure-policy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.