Documentation
Login

AlertHub Vulnerability Disclosure & Security Policy

Last updated: 23/10/2026 13:32 UTC

At AlertHub (alerthub.io), security and system integrity are paramount. We appreciate the efforts of security researchers and developers who help keep our real-time event pipeline and users safe. If you believe you have discovered a vulnerability, security flaw, or sensitive data exposure, we ask that you work with us to disclose it responsibly according to this policy.

Coordinated Disclosure Guidelines (Mandatory)

To qualify for safe harbor and consideration of any reward, you must adhere strictly to the following terms:

  • Private Reporting First: All findings must be reported directly and privately to hello@alerthub.io (or through our secure contact form).
  • No Public Disclosure: You agree not to publicly disclose, blog, tweet, discuss, or share any details of the vulnerability with third parties before AlertHub has remediated the issue and authorized public disclosure, or until at least ninety (90) days have elapsed from our confirmation of receipt.
  • Protect User Data: Do not access, modify, purge, or leak data belonging to other AlertHub users or accounts. Only test against accounts or endpoints that you own and control.
  • Maintain Service Availability: Do not perform testing that degrades platform reliability, impacts other users, or causes service degradation.

Bounty & Payment Policy (Sole Discretion)

AlertHub does not run a guaranteed commercial bug bounty program. Any monetary payments, bounties, or recognition are awarded entirely at our sole discretion:

  • Discretionary Evaluation: We reserve the exclusive right to determine whether a report warrants a reward, the value of any monetary compensation, or whether to offer acknowledgment instead.
  • No Entitlement: Submitting a valid report does not automatically entitle you to financial compensation, and we are under no legal or contractual obligation to pay bounties.
  • Disqualification & Extortion: Demanding payment, setting deadlines for compensation, threatening public exposure, or attempting extortion will immediately disqualify you from any bounty consideration, void safe harbor protections, and may result in a report to law enforcement.

In-Scope & Out-of-Scope Vulnerabilities

In-Scope:

  • The core AlertHub web platform (alerthub.io) and official subdomains.
  • AlertHub ingestion APIs and public endpoints (/api/*).
  • Critical server-side flaws (e.g., Remote Code Execution, SQL Injection, Authentication Bypass, Broken Object-Level Authorization / BOLA, Server-Side Request Forgery / SSRF).
  • Sensitive data leaks or unauthorized cross-tenant data access.

Out-of-Scope (Reports that will be closed without reward):

  • Denial of Service (DoS / DDoS) attacks or testing API volumetric limits.
  • Spamming, brute-forcing contact forms, or bypassing honeypot mechanisms without practical vulnerability.
  • Automated vulnerability scanner outputs (e.g., Acunetix, Burp Suite, Nessus) without a working, validated proof-of-concept (PoC).
  • Missing DNS security records (SPF/DKIM/DMARC) unless leading directly to verified exploitation.
  • Missing HTTP security headers (e.g., Strict-Transport-Security, Content-Security-Policy) that do not lead to an exploitable vulnerability.
  • Social engineering, phishing, or physical attacks against AlertHub staff or infrastructure.

Safe Harbor Protection

If you conduct your vulnerability research and reporting in good faith, strictly adhere to this policy, and refrain from compromising system stability or user privacy:

  • We will consider your research to be authorized and will not initiate legal action against you under computer misuse or hacking legislation.
  • We will work collaboratively with you to understand, reproduce, and resolve the issue.

How to Submit a Security Report

Send an email to hello@alerthub.io with the subject line:[Vulnerability Report] Brief description.

Please include:

  • A detailed description of the vulnerability and its potential impact.
  • Step-by-step reproduction instructions or a minimal Proof of Concept (PoC) script/request.
  • Affected endpoints, parameters, or mobile client build versions.
  • Your preferred name or handle if you wish to be credited once resolved.

We aim to acknowledge initial submissions within 48 to 72 business hours.