This page explains how to report a security vulnerability in AliasFleet, what a complete report contains, and what happens after a report is sent. A reader who follows it will be able to submit a report by email or support ticket, include the details needed for confirmation, and follow the limits that apply while the report is open.
What counts as a security report?#
A security report describes a weakness in AliasFleet itself, for example a flaw that could expose data, permit unauthorised access, or bypass a control in the service. A report about one account that was accessed without permission is a separate case, and it follows the compromised account path at the end of this page.
Only the details listed on this page are needed. Reports are accepted by email at security@aliasfleet.com or through a support ticket, and no other channel is required.
How do I report a security issue?#
A report is sent in four steps.
- Choose a channel. Send an email to security@aliasfleet.com or open a support ticket.
- Describe the issue. State the issue in plain terms, and name where it was found, including the page, feature, or part of the service involved.
- Add reproduction steps. List the steps that reproduce the issue, in order, so the finding can be confirmed. Include only the steps needed for confirmation.
- State the possible exposure. Explain what information or access the issue could expose, and the conditions under which that exposure could occur.
What should a report include?#
A complete report contains four items. A finding cannot be checked without them, so a report missing an item takes longer to confirm.
| Item | What to write |
|---|---|
| What the issue is | A plain description of the weakness |
| Where it was found | The page, feature, or part of the service involved |
| Steps to reproduce | The ordered steps that reproduce the issue, where possible |
| Possible exposure | What information or access the issue could expose |
A report that contains all four items is simpler to confirm and to fix. Where a step cannot be reproduced reliably, that fact should be stated plainly rather than filling the gap with a guessed sequence.
What happens after a report is sent?#
The report is acknowledged and then investigated. If the issue is confirmed, work on a fix follows and the reporter is kept updated on progress. Acknowledgement and investigation time vary, and investigation time depends on the complexity of the issue, so no fixed time is promised on this page.
No formal bug bounty program exists. Responsible disclosure is appreciated, and credit in the acknowledgements is given on request.
What should a reporter not do?#
Three limits apply while a report is open.
- Do not exploit beyond confirmation. Testing stops at the point that confirms the issue exists.
- Do not access or modify other users' data. A report never justifies reading, changing, or deleting data that belongs to another account.
- Do not disclose publicly before a fix. Details stay private until a fix is in place, because early disclosure risks wider exposure before users are protected.
Responsible disclosure gives the issue time to be fixed before it reaches a wider audience.
What if an account itself is compromised?#
A compromised account is not a vulnerability report, and it follows a different path.
- Revoke unknown sessions. Open the Active Sessions guide and revoke any session that is not recognised.
- Change the password. Follow the Changing Your Password guide.
- Open a support ticket. After the sessions are revoked and the password is changed, open a support ticket so the access can be looked into.
For general account checks beyond these steps, the Security Tips guide covers the remaining settings to review.