Security disclosure
Reporting a vulnerability
If you have found a security problem in REAL AUTH, we want to hear about it, and we will not treat the report as an attack.
How to report
Email security@real-auth.com with enough detail to reproduce the issue: the affected URL or endpoint, the steps, and what you were able to achieve. If you would like to encrypt the report, say so and a key will be provided.
What to expect
Acknowledgement within three working days, an assessment of severity, and updates as the fix progresses. If we disagree with your assessment we will explain why rather than going quiet.
What we ask
Please do not access, modify or delete data belonging to other people, do not run denial-of-service tests against production, and give us reasonable time to fix an issue before publishing. Testing against your own sandbox account is explicitly welcome.
Scope
real-auth.com and its subdomains, the API, and the published client code. Findings that depend on a compromised device, on social engineering of our staff, or on a third-party service we do not control fall outside scope, though we will still read the report.
Recognition
There is no paid bounty programme at this stage, and pretending otherwise would waste your time. Valid reports will be credited publicly if you want that, and a programme will be announced here if one is introduced.