Vulnerability Disclosure

Version 2026-10-05 · Effective 2026-10-05Scope: Good-faith security reporting, prohibited testing, initial report content, and coordinated disclosure.Policy contact: security@attestlayer.comRelated: Security and Data Handling · Acceptable Use Policy

We welcome reports about the security of our public sites, API, Console, Verify and Registry at security@attestlayer.com. We acknowledge within 3 business days and keep you informed until the issue is resolved. Please test only against your own accounts and data, don't access or alter other customers' data, and don't run denial-of-service or social-engineering tests. We won't take legal action against good-faith research that follows these rules. We don't run a paid bounty. Our security.txt points here.