Security
Report a vulnerability
If you think you have found a security problem in Auray — the app, the API, this site or our console — write to security@auray.ai. Please don’t report it through the help form or in public.
Write to us
Send your report to security@auray.ai. It reaches our team as soon as it arrives — there is no confirmation link to click — and a person reads it.
Say what you found
Where it is (the address, the request or the screen), the steps that show it, and what someone could do with it. A short report with steps beats a long one without.
We write back
We reply by email, tell you what we found when we look, and let you know when it is fixed.
While you look
What we ask
- Use your own account and your own data. Don't open, change or delete anyone else's — if you come across it, stop, keep none of it, and tell us what you saw.
- Don't degrade the service: no denial-of-service, load tests or floods of automated requests, and no spam through our forms or webhooks.
- Don't try to trick our team or our customers, and don't test anything physical.
- Give us a fair chance to fix it before you tell anyone else.
Not a report
What we can’t act on
- A scanner's output with no way shown to use it.
- A missing header or setting, without a way to use its absence.
- Something that only works on a browser or device that no longer gets updates, or on one that is already compromised.
A problem with your own account or a charge is for Help; a page on auray.app that tries to trick people is reported from there too.
This page is also published as /.well-known/security.txt on auray.ai, app.auray.ai, api.auray.ai and admin.auray.ai, good until 28 October 2027.