Reporting a vulnerability

If you believe you have found a security vulnerability in SecFlow (secflow.app and its APIs), email info@aidev.se with the subject "Security report". Include what you found, how to reproduce it and the potential impact.

What we ask

Test only against your own accounts and do not access, change or delete other people's data.
Do not run denial-of-service, spam or social-engineering tests, and do not test third-party services.
Give us reasonable time to fix the issue before disclosing it publicly.

What you can expect

We aim to acknowledge reports within five business days and to keep you informed while we investigate. We will not pursue legal action against good-faith research that follows this policy. We do not run a paid bug bounty programme.