If you have found a security vulnerability in an AlphaNodes product or service, please report it to us using the form on this page. Your report goes directly to our team.

Already a customer? Then please report the vulnerability through our customer area. Your report is protected there, and we can assign it directly to your account. The form on this page is for everyone who does not have access to the customer area.

What this page covers

  • our Redmine plugins
  • our managed hosting
  • this website

For questions about orders, licences or support, please use the contact form or the customer area.

What helps us

  • the affected plugin with plugin version and Redmine version
  • a description of the vulnerability and how to reproduce it
  • whether the vulnerability is already publicly known or being exploited
  • proof that the vulnerability can actually be exploited

You can send evidence such as screenshots or a short script once we have got back to you.

What we do not treat as a vulnerability

  • visible version numbers
  • missing security headers
  • clickjacking
  • denial of service, brute force and phishing
  • vulnerabilities in plugins from other vendors, community plugins or custom developments
  • output from automated scanners that you have not verified yourself

Rules for testing

  • Only test installations that you own or have permission to test.
  • Reproduce the vulnerability on an installation that runs only Redmine and AlphaNodes plugins. This is the only way to rule out that it comes from another plugin or a custom development.
  • Do not access other people’s data and do not destroy data.
  • Do not overload systems and do not run automated tools against our servers.
  • Do not test our forms.

What happens next

We review your report and get back to you. If the vulnerability is confirmed, we fix it and publish an update. Please do not make the vulnerability public until the update is available. We do not pay bounties for reported vulnerabilities.

Information obligation according to GDPR Art. 13

Before establishing an initial contact with us, we refer you to our data protection regulations.
You can find our privacy policy here: https://alphanodes.com/privacy

About you About the vulnerability

¹ Note: You can revoke your consent at any time for the future by email.