Security policy
This is a translation for convenience. The binding version of this document is the Spanish one: the Spanish version. In case of discrepancy, the Spanish text prevails.
Found a security bug? Email
security@aseptic.dev with
[SECURITY] in the subject. We acknowledge within 72 hours.
How to report
Email security@aseptic.dev — or
info@aseptic.dev, which also reaches us — with [SECURITY] in
the subject.
Do not open a public issue for a security bug: it is visible before a fix exists, which leaves everyone on the affected version exposed.
It helps a lot to include your Aseptic version and operating system, steps to reproduce, what an attacker gains, and a proof of concept if you have one. If you would rather encrypt the email, ask for the key in a message without details.
What we will do, and when
| Deadline | What |
|---|---|
| 72 hours | Acknowledgement. A human has read your email |
| 7 days | Assessment: whether we reproduce it, the severity we assign, and the plan |
| By severity | Fix: critical in 7 days, high in 30, medium in 90, low in the next regular release |
| 90 days | Coordinated disclosure, with credit if you want it |
If we cannot meet a deadline we tell you why before it lapses. If you disagree with the severity we assigned, say so — it is up for discussion.
Coordinated disclosure
We publish details once a fix exists and there has been reasonable time to update, and in any case 90 days after the report even if unresolved: staying quiet indefinitely protects the vendor, not the user.
We will not take legal action against anyone researching in good faith under this policy: without accessing third-party data, without degrading the service, without extracting more information than needed to demonstrate the flaw, and without disclosing early.
There is no bug bounty. There is public credit in the advisory, if you want it.
Scope
In scope: the desktop application, the aseptic CLI, the MCP server, the copilot, the
auto-update process, and the mcp.aseptic.dev and aseptic.dev services.
Out of scope: the third-party services we integrate — Cloudflare, Kinde, Paddle, Sentry and AI providers — which have their own channels; the microservices you orchestrate, which are yours; and findings that assume the attacker already controls the machine, because at that point there is nothing left to protect.
What we are especially interested in, given what the product does: escapes from credential scrubbing before a send, flaws in auto-update signature verification, team catalogue leaks across organisations, and any way for the copilot to execute something the user did not approve.
Security support
We maintain security support for the current version line for at least twelve months from the first stable release, in line with Regulation (EU) 2024/2847. During beta, fixes always land on the latest published version: they are not backported to earlier betas.
Fixes travel through the auto-update channel, which is on by default. Advisories go out in the release notes and on this page.
Notifying the authorities
As the manufacturer of a product with digital elements placed on the EU market, we notify ENISA and the relevant CSIRT of actively exploited vulnerabilities and severe incidents, within the deadlines of article 14 of Regulation (EU) 2024/2847. If the flaw you report is being exploited, tell us: it changes every timeline above.
Third-party components
Aseptic bundles open source components, listed in the THIRD-PARTY-NOTICES file shipped
with the application. Their vulnerabilities are tracked automatically and fixed by
upgrading. If the flaw is in the component rather than in our use of it, we report it
upstream and note it in our advisory.
How we design so there is less to report
Not a promise, just what the product does: what never leaves your machine cannot leak from ours. Code, logs, data and secrets never travel. The hosted team catalogue is end-to-end encrypted with a key we do not hold. Diagnostics stay off until you turn them on. The detail is in the Privacy Policy.