AutoRize security policy

Last updated 2026-05-17.

AutoRize takes the security of its web app, MCP server, mobile clients, and the data they handle seriously. If you believe you have found a vulnerability, we want to hear about it.

Reporting a vulnerability

Please email security@autorize.ro with:

  • A description of the issue and its potential impact.
  • Steps to reproduce, with any proof-of-concept code or screenshots.
  • The affected surface (autorize.ro, app.autorize.ro, mcp.autorize.ro, mobile apps, blog).
  • Your name or handle for credit, if you want to be acknowledged.

We aim to acknowledge new reports within 3 business days and to keep you updated as we investigate.

In scope

  • autorize.ro and all subdomains we operate (app.autorize.ro, mcp.autorize.ro, api-app.autorize.ro).
  • The AutoRize MCP server at mcp.autorize.ro/api and its OAuth surface.
  • AutoRize mobile apps (iOS, Android) when published.
  • The AutoRize WordPress integration plugin.

Out of scope

  • Vulnerabilities in our third-party processors (OpenAI, Google, Stripe, Anthropic, Azure, AWS); please report those directly to the vendor.
  • Reports requiring physical access to a victim's device, social engineering of AutoRize staff, or denial-of-service through traffic volume.
  • Issues already publicly disclosed.
  • Theoretical issues without a demonstrated impact path.

Safe harbour

If you make a good-faith effort to comply with this policy during your security research, we will consider that research to be authorised, we will work with you to understand and resolve the issue quickly, and we will not pursue or support legal action related to your research.

Coordinated disclosure

We ask that you give us a reasonable opportunity to investigate and remediate before any public disclosure. We are happy to credit you in any public advisory once the issue is resolved.

Machine-readable

A /.well-known/security.txt is published per RFC 9116 with the same contact and policy URLs.