Responsible disclosure

A problem in anlyon.dev

If you find a security problem in anlyon.dev itself, for example a way to make its scanner reach an address it should not, email support@anlyon.com with the subject "anlyon.dev security". Include what you did and what happened. Please give us a reasonable time to fix it before you publish, do not access data that is not yours, and do not degrade the service for others. We will not take action against good-faith research that follows these rules.

A problem in a listed server

anlyon.dev shows what it found in tool definitions as evidence, with no verdict. If you have found a vulnerability in a listed server, report it to that server's publisher first, through the repository or website on its listing. We do not publish vulnerability reports about third-party servers.

If a finding on a listing reveals something a publisher has asked to fix privately, tell us and we will hold the listing while they do.

The indexer

Requests from anlyon.dev carry the User-Agent anlyon.dev-indexer/0.1 (+https://anlyon.dev/about; support@anlyon.com). What it sends is on the about page.