Report a vulnerability
If you find a weakness in any Pauhu site or service, tell us. We follow coordinated disclosure: you report to us first, we fix it, and only then is it made public.
Send your report to this address. Good-faith reports under this policy are not pursued.
Please include:
- what you found and where,
- the steps to reproduce it,
- what you think the impact is.
Please do not:
- read, change or keep other people's data,
- disrupt the service or run denial-of-service tests,
- share the details publicly before we have had a chance to fix it.
What happens after a report
- We confirm that we received it.
- We assess it and tell you what we found.
- We fix it, and we tell you when it is fixed.
- If you wish, we credit you by the name you choose.
Our targets: we acknowledge a report within 72 hours and assess its severity within 7 days. Public disclosure is agreed with you, by default after 90 days.
Connecting devices
Network and security teams can find the firewall and network setup for devices that call the Pauhu AI API in our public repository, with example rules for common firewalls.
Device network and firewall setup
Security practice
Pauhu keeps its security practice in-house.
Compliance*: frameworks and their references
*In-house assessment