Security & Vulnerability Disclosure
Last updated: May 2026
Reporting a vulnerability
If you believe you have found a security issue in ArtiProof — anything that could affect the confidentiality, integrity, or availability of researcher data — please email security@artiproof.com with a clear reproduction, the affected URL or endpoint, and your name (or a handle) for credit.
A machine-readable copy of this contact is also published at /.well-known/security.txt per RFC 9116.
What you can expect
- Acknowledgement within 2 business days of receipt.
- An initial triage and severity assessment within 5 business days.
- Coordinated disclosure once a fix is in production. We will credit you in the changelog unless you ask us not to.
- No legal action against good-faith research that follows this policy. Test on your own accounts only — do not access other users' data.
Scope & out-of-scope
In scope: the production web application at artiproof.com, the public API under /api/*, and any subdomains we own. Out of scope:
- Volumetric DoS / spam. Test our rate limits responsibly.
- Reports that consist only of an automated scanner's output with no demonstrated impact.
- Social engineering of ArtiProof staff, customers, or partners.
- Third-party services we use (Resend, Gemini, CrossRef, OpenAlex). Report those to their respective vendors.
Encryption
Sensitive details can be encrypted with our PGP key, available on request from security@artiproof.com.