Security and vulnerability disclosure

How to report

Email info@vernesystems.com with “Security” in the subject line. Please include:

• a description of the problem and its likely impact;
• the steps to reproduce it, with any proof-of-concept code or screenshots;
• the affected URL, or the affected part of Asten with its version or build date and your operating system; and
• whether, and how, you would like to be credited.

Please do not include anyone else’s personal data or manuscript. If you need to send something sensitive, say so in your first message, and Verne will reply with how to send it.

In scope

• This website.
• Asten builds distributed by Verne, including the desk and the desktop app.
• The Asten local API.
• The Word task pane and the Google Docs sidebar.

Out of scope

• Social engineering, phishing, or physical attacks against Verne or its people.
• Denial-of-service attacks, or any test that degrades the website for others.
• Services run by third parties, such as Vercel, Microsoft, and Google. Please report those to them.

About the local API

The Asten local API binds to the loopback address, 127.0.0.1:4317, by default, so only software on the same computer can reach it. It can be configured to listen elsewhere; if you do that, put it behind your own access controls. Problems with how the API behaves on loopback, including how it treats requests from web pages open in your browser, are in scope.

Safe harbor

If you research and report in good faith under this policy, Verne will treat your research as authorized, will not pursue or support legal action against you for it, and will work with you to understand and fix the problem. Good faith means you:

• test only against your own installation and data, or systems you are authorized to test;
• avoid privacy violations, destruction of data, and interruption of service;
• access only what you need to show the problem, and stop and report as soon as you have;
• do not disclose the problem before Verne has had a reasonable chance to fix it; and
• follow the law.

This safe harbor covers Verne’s own claims. It cannot bind third parties such as Vercel, Microsoft, or Google. If you are unsure whether something is allowed, ask first.

What happens next

Verne will acknowledge your report within 5 business days, keep you informed, and tell you when the problem is fixed.

Please give Verne 90 days from your report before disclosing it publicly, so a fix can reach people first. If a fix needs longer, Verne will explain why and agree a date with you. If a fix ships sooner, Verne is happy to coordinate an earlier disclosure.

Rewards

Verne does not run a bug bounty and does not currently pay for reports. Your help is appreciated all the same.

Machine-readable contact

The contact details in this policy are also published at /.well-known/security.txt on this site, in the standard security.txt format.