# AuthPlane — Responsible disclosure

> Responsible disclosure policy for AuthPlane. Report vulnerabilities to security@authplane.ai or via GitHub Private Vulnerability Reporting.

- Canonical HTML: https://authplane.ai/security/
- Machine-readable metadata: https://authplane.ai/.well-known/security.txt (RFC 9116)

## Reporting a vulnerability

If you believe you've found a security issue in AuthPlane — the authorization server, any SDK, or this website — report it via one of the paths below. Do not open a public GitHub issue for security matters.

- **Preferred — GitHub Private Vulnerability Reporting:** https://github.com/authplane/authserver/security/advisories/new — end-to-end encrypted, tracked, versioned.
- **Email:** security@authplane.ai — include a reproducer, affected version(s), and a suggested severity.

## What we commit to

- Acknowledge receipt within 3 business days.
- Provide an initial assessment within 10 business days.
- Coordinate a disclosure window that fits the severity and downstream user impact.
- Credit reporters in the advisory unless you prefer to remain anonymous.

## Scope

In scope: the AuthPlane authorization server binary, the published SDKs (Python, TypeScript, Go), the marketing site (`authplane.ai`), and the docs (`docs.authplane.ai`).

Out of scope: findings that require physical access, social engineering, or a rooted client; denial-of-service via automated fuzzing without a novel attack vector.

## More context

The threat model, key-management practices, and DPoP posture are documented at https://docs.authplane.ai/security/threat-model.