Security

Alumia is built around authenticated access, organization-scoped data, explicit approval boundaries, protected secrets, and auditable state changes. This page describes practices, not a certification or a guarantee that incidents cannot occur.

Current practices

The application uses encrypted transport, server-owned authorization, tenant checks, rate limits on sensitive public paths, secure session cookies in production, signed provider callbacks, append-only billing corrections, and secret scanning in the delivery workflow.

Report a vulnerability

Report security vulnerabilities to [email protected], with "Security" in the subject. Each security report is acknowledged within one working day and passed to our security team.

The same address is published for automated discovery at /.well-known/security.txt. Include the affected URL, impact, and reproduction steps. Do not include credentials, private user data, or destructive proof.

Safe-harbor boundaries

Avoid privacy violations, service disruption, social engineering, persistence, data destruction, denial of service, automated high-volume scanning, and accessing more data than needed to demonstrate an issue. Stop and report immediately if you encounter user data.

Operational updates

Service notices and maintenance guidance are linked from the Status page.