# Security Policy

Aletheia Tech Ltd (BlockchainAnalysis.io) welcomes responsible disclosure of security
vulnerabilities.

## Reporting a vulnerability

- **Email:** contact@blockchainanalysis.io (subject: `SECURITY`).
- Please include: a description, steps to reproduce, affected URL/endpoint, and any PoC.
- Do **not** publicly disclose the issue until we have had a reasonable opportunity to remediate.
- Do **not** access, modify or exfiltrate other users' data, run denial-of-service, or degrade the
  service while testing.

## Our commitment

- We aim to acknowledge reports within **3 business days** and to keep you updated on remediation.
- We will not pursue legal action for good-faith research that follows this policy.
- We do not currently run a paid bug-bounty program; we are happy to credit reporters.

## Scope

In scope: `blockchainanalysis.io` and its subdomains, and our published APIs. Out of scope:
third-party services we depend on (report those to the respective provider), social-engineering,
and physical attacks.

Machine-readable contact: https://blockchainanalysis.io/.well-known/security.txt