Responsible disclosure

How to report

Email security@algoryq.com with what you found, how to reproduce it, and the impact you think it has. If you need to send something sensitive, say so and we will arrange a way.

What we commit to

• Acknowledged within two working days, by a person, not an autoresponder.
• Our severity assessment, and why, within five working days.
• Updates while we fix it, rather than going quiet.
• Public credit if you want it, silence if you do not.
• No threats, and no lawyers, over a report made in good faith under this policy.

In scope

• The product at the application and API domains.
• This website.
• Anything that lets one institute reach another's data. This is the one we care about most: isolation is the load-bearing claim of the whole system.
• Authentication, session handling and permission bypasses.

Out of scope

• Findings from automated scanners with no demonstrated impact.
• Missing headers on a static page that has no session and sets no cookie.
• Social engineering of our people, or physical access.
• Denial of service. Please do not.
• Anything requiring a compromised device or an already-phished person.

What we ask while you look

• Use your own test institute. Do not touch anybody else's data.
• If you reach data that is not yours, stop and tell us what you saw so we can assess the exposure. Do not download it.
• Do not degrade the service for anybody else.
• Give us a reasonable window before publishing. We will not use it to stall.

Money

No bug-bounty programme: we have no revenue yet, and running one badly is worse than not running one. Better said plainly than implying a reward that does not exist. When there is a programme, this page will say so.