Security & Vulnerability Disclosure

How to Report

• Email: security@athencia.com
• Web: https://athencia.one/security
• Optional encryption: https://athencia.one/security/pgp.txt
• Include: affected URL/app, steps to reproduce, expected vs. actual behavior, impact, and any minimal PoC or screenshots.

Response targets: we aim to reply within 3 business days and triage within 7 days. We'll keep you informed as we work toward a fix.

Safe Harbor (Good-Faith Research)

If you follow this policy, act in good faith to avoid privacy harm or service disruption, and report promptly, Athencia will:

• Consider your research authorized under this policy.
• Not pursue legal action or law-enforcement referrals for your research.
• Work with you to understand and resolve the issue.

This safe harbor applies only to good-faith, policy-conformant research on in-scope assets (below).

Scope

In scope:

• athencia.one and Athencia-owned subdomains (e.g., marketing pages, public forms, and endpoints we list here in future updates).

Out of scope (please don't test):

• Social engineering (phishing, vishing, smishing) of Athencia staff, customers, or partners.
• Physical security, spam, or DDoS/volumetric attacks.
• Third-party platforms we don't control (including hosting, CRM, or SaaS vendors).
• Automated scanning that degrades service or generates excessive traffic.
• Accessing, modifying, or exfiltrating data you don't own.

Testing Guidelines

• Use test accounts and data you own; don't access real customer data.
• Limit PoCs to what's necessary to demonstrate impact.
• Avoid privacy violations or service interruptions.
• Respect rate limits and stop testing if you encounter live, sensitive data. Report immediately.

What We'd Like to See in a Report

A high-quality report typically includes:

• Affected asset/URL and vulnerability type.
• Reproduction steps with clarity (copy/paste commands where helpful).
• Realistic impact and severity assessment.
• Suggested remediation ideas, if any.

Our Security Baselines

• TLS everywhere with modern configurations and security headers where applicable.
• Email authentication (SPF, DKIM, DMARC) on company domains.
• Principle of least privilege, MFA/Conditional Access, and encrypted data at rest where supported.
• Vulnerability management and prompt patching for supported systems.