Security Policy
Last updated: October 15, 2026
Reporting a Vulnerability
If you believe you have found a security vulnerability in a DataHubz service, please email contact@datahubz.com with “Security” in the subject. Include what you found, where (the address of the page or endpoint), the steps to reproduce it, and what you believe its impact is. Please give us reasonable time to look into it and fix it before sharing it with anyone else.
This policy is also published, in the machine-readable form described in RFC 9116, at datahubz.com/.well-known/security.txt and attest.datahubz.com/.well-known/security.txt.
Scope
This policy covers the services DataHubz operates:
- datahubz.com
- attest.datahubz.com (DataHubz Attest), including its connector for AI assistants at attest.datahubz.com/mcp
- hubz.datahubz.com (Hubz) and rubro.datahubz.com (Rubro)
Some behavior is intentional and documented. For example, Attest’s connector accepts dynamic client registration, as the Model Context Protocol specifies, so that AI assistants and developer tools can connect; every connection still requires a signed-in person to approve it. Attest’s design and what it proves are described at attest.datahubz.com/docs.
Testing in Good Faith
When you look for vulnerabilities, please:
- Use only accounts you own or have permission to use, and never access, change, or delete other people’s data.
- Stop as soon as you can show the issue, and don’t keep any data you came across.
- Don’t degrade or interrupt the services: no denial-of-service testing, load testing, or automated scanning at high volume.
- Don’t use social engineering, phishing, or physical attacks against our people, customers, or providers.
- Don’t send email or messages to people other than yourself through our services.
If you follow these guidelines and report what you find to us first, we will treat your research as authorized, will not pursue or support legal action against you for it, and will work with you to understand and fix the issue.
What to Expect From Us
- We will acknowledge your report and let you know how we assess it.
- We will check what you report against our systems, fix confirmed vulnerabilities, and tell you when they are fixed.
- With your permission, we are glad to thank you by name when we describe a fix.
DataHubz does not run a bug bounty program and does not pay for reports. Reports of behavior that is intentional and documented, or of best-practice suggestions without a demonstrated impact, may receive a short reply.