Vulnerability Disclosure Policy

Last updated: 3 October 2026

Found a security problem? Email ops@amlr.io with "Security" in the subject. We reply within 3 working days. We do not pay rewards, and we will not take legal action against good-faith research that follows this policy.

1. Scope

In scope: the amlr.io platform at app.amlr.io (including the counterparty onboarding links it serves) and this website, amlr.io.

Out of scope: denial-of-service and load testing, social engineering or phishing of our staff or customers, physical attacks, and the services of our third-party providers, which have their own programmes. Reports from automated scanners without a demonstrated impact, missing best-practice headers with no exploit, and issues that need a compromised device are generally not accepted.

2. How to report

Email ops@amlr.io with:

what you found and where (the URL or feature);
the steps to reproduce it, and what an attacker could do with it;
whether any customer data was exposed to you.

Please keep the details confidential until we have fixed the issue and agreed a disclosure date with you.

3. Rules for testing

Use only accounts you own or have been given permission to use. Do not access, change or delete other people's data. If you reach personal data by accident, stop, do not keep a copy, and tell us.
Do not degrade the service for others, and do not use automated tools at volume.
Do not upload malware, or anything that is not yours to share, through the onboarding forms.
Stop and report as soon as you have demonstrated the issue. Do not try to go further into our systems.

4. What we commit to

Acknowledge your report within 3 working days, and tell you within 10 working days whether we can confirm it.
Fix confirmed critical issues within 7 days and high-severity issues within 30 days, and keep you informed along the way.
Credit you publicly once the issue is fixed, if you would like that.

5. Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorised. We will not pursue or support legal action against you, and if a third party does, we will make it known that you acted within this policy. This does not authorise testing of systems we do not own.

6. Rewards

We do not offer monetary rewards. Please do not send reports that ask for payment as a condition of disclosure.

This policy is aligned with ISO/IEC 29147 and ISO/IEC 30111. Machine-readable contact details: /.well-known/security.txt.