Security reporting

Assayra exposes a public, rate-limited coordinated-disclosure endpoint. It is intended for reports about Assayra itself; do not submit applicant identity data, document images, biometric evidence, authentication secrets or payment-card data.

Report content and reporter contact details are encrypted before storage. The notification sent to the configured security inbox contains only the case reference, category and severity. It does not copy the report body into email or the sales queue.

Submit a report

POST /v1/public/security-reports
Content-Type: application/json

{
  "reporterName": "Security Researcher",
  "reporterEmail": "researcher@example.net",
  "category": "vulnerability",
  "severity": "high",
  "summary": "Short, non-sensitive description",
  "details": "Reproduction steps with secrets and personal data removed.",
  "disclosurePreference": "coordinated",
  "privacyAccepted": true
}

The endpoint is public and does not accept tenant bearer tokens. privacyAccepted must be true.

{
  "status": "received",
  "reference": "SEC-01K0...",
  "message": "Your report was received by the Assayra security team."
}

Keep the returned reference for follow-up. A successful response confirms intake only; it is not a finding, severity decision or disclosure authorization.

Web SDK

import { Assayra } from "@assayra/sdk-web";

const publicClient = new Assayra({
  baseUrl: "https://api.assayra.example",
});

const receipt = await publicClient.security.report({
  reporterName: "Security Researcher",
  reporterEmail: "researcher@example.net",
  category: "vulnerability",
  severity: "high",
  summary: "Short, non-sensitive description",
  details: "Reproduction steps with secrets and personal data removed.",
  disclosurePreference: "coordinated",
  privacyAccepted: true,
});

console.log(receipt.reference);

Categories and severity

Field	Allowed values
category	vulnerability, suspected_incident, privacy, other
severity	critical, high, medium, low, unknown
disclosurePreference	coordinated, private, no_preference

Severity is the reporter's initial estimate. Assayra security personnel triage and assign the operational status in the separately authorized Control Tower queue.

Errors and abuse controls

Status	Meaning
400	The request is invalid or the privacy acknowledgement is missing.
429	The public intake rate limit was exceeded. Retry only after the response interval.
503	Production security-inbox delivery is not correctly configured.

The form contains an invisible bot-trap field. Legitimate clients must omit unknown fields instead of populating form controls discovered by DOM scraping.

Operational boundary

Only Assayra workforce identities with the security:reports scope can list, read or change security-report status. Tenant administrators, tenant API keys, sales users and billing operators cannot access the queue. Status changes are recorded in the workforce audit trail.

Review the security disclosure policy on the Assayra commercial site before testing. Do not perform denial-of-service testing, access another person's data, or retain evidence beyond what is necessary to report the issue. See also the developer-reference security guidance.