Amaretto Software Labs

Vulnerability Disclosure Policy

How to report security issues in our websites, services, and developer tools

Vulnerability Disclosure Policy

Last updated: April 9, 2026

Amaretto Software Labs welcomes responsible security research. If you discover a vulnerability in our websites, products, or hosted services, please report it privately so we can investigate and remediate it.

Scope

This policy covers security vulnerabilities affecting:

  • amarettosoftware.com and its subdomains
  • Hosted services operated by Amaretto Software Labs
  • Open-source repositories published under the Amaretto Software Labs GitHub organization
  • Related APIs, administrative interfaces, and supporting infrastructure that we operate

If you are unsure whether a finding is in scope, send it anyway and we will clarify.

How to Report

Please send reports to:

  • Email: contactamarettosoftware.com

Please include as much of the following as possible:

  • A clear summary of the issue
  • The affected product, service, URL, or repository
  • Steps to reproduce
  • Proof of concept, screenshots, or request/response samples where relevant
  • The potential security impact
  • Any suggested mitigation if you already have one

If you want encrypted communications, mention that in your initial report and we will coordinate a secure channel.

No Bug Bounty Program

Amaretto Software Labs does not currently operate a paid bug bounty program.

  • We welcome responsible disclosure
  • We may acknowledge valid reports publicly if you want credit
  • We do not offer guaranteed financial rewards, bounty payouts, or compensation for reported vulnerabilities

What We Ask From Researchers

Please:

  • Give us a reasonable opportunity to investigate and fix the issue before public disclosure
  • Avoid accessing, modifying, or deleting data that does not belong to you
  • Avoid actions that could degrade the availability of our services
  • Avoid social engineering, phishing, physical attacks, or attacks against third-party infrastructure
  • Stop testing and notify us immediately if you access sensitive data unintentionally

Safe Harbor

We will not pursue legal action against researchers who:

  • Act in good faith
  • Follow this policy
  • Avoid privacy violations, data destruction, and service disruption
  • Report findings promptly and privately

This safe harbor applies only to security research activities intended to improve the security of our systems. It does not authorize actions that violate law or target systems outside this policy's scope.
It also does not create any entitlement to payment, bounty awards, or reimbursement.

Response Expectations

We aim to:

  • Acknowledge new reports within 3 business days
  • Provide an initial assessment as quickly as practical
  • Keep you informed on remediation progress for valid reports
  • Credit you for the discovery if you would like public acknowledgment after remediation

Response and remediation timelines vary with severity, exploitability, and operational risk.

Out of Scope

The following are generally out of scope unless they demonstrate a concrete and material security impact:

  • Missing best-practice headers without exploitability
  • Clickjacking on non-sensitive pages
  • Rate-limit observations without demonstrated abuse impact
  • Vulnerabilities in third-party services we do not control
  • Spam, social media impersonation, or content policy issues
  • Denial-of-service testing or other high-volume traffic generation

Open Source Security Issues

If the issue affects one of our open-source repositories, you may still report it privately to contactamarettosoftware.com. Do not open a public issue for unpatched vulnerabilities unless we explicitly agree on coordinated disclosure timing.

Contact

For all security disclosure matters:

We appreciate responsible disclosure and the time researchers invest in helping keep our users and systems secure.