Founding offer: 40% off the first payment on selected apps with code FOUNDING40, until 30 November 2026.40% off selected apps’ first payment: FOUNDING40 until 30 Nov. See founding prices

Atesen Software Find your appAll apps
Menu

Security

If you have found a vulnerability in this website or in one of our applications, we want to hear about it directly.

Reporting a vulnerability

Email support@atesensoftware.com with Security in the subject line. Please include what you found, the exact steps to reproduce it, and the impact you believe it has. We will confirm receipt, tell you what we find, and let you know when a fix ships.

Please give us a reasonable period to fix an issue before disclosing it publicly, do not access or modify data that is not yours, and do not run denial-of-service or automated load tests against our systems or against a customer's account.

We do not operate a paid bug bounty. We will credit you by name if you would like that, and we will not pursue a good-faith researcher who follows the guidance above.

How this website is built

  • Static files only. There is no server-side application, no database, no user account and no payment processing behind this site.
  • The catalogue and documentation pages load no third-party scripts, fonts, embeds or trackers. Gem Grid Blast for Telegram is an exception: it loads the Telegram Web App SDK and AdsGram advertising SDK, including outside Telegram. These providers receive your IP address and browser request information, and their scripts run in the game page. See the privacy policy for this separate data flow.
  • HTTPS is enforced, with HTTP Strict Transport Security.
  • Responses carry a restrictive content security policy, frame protection, MIME sniffing protection and a strict referrer policy.
  • The site is built from a public source tree that contains no credentials; deployment secrets live in the deployment platform, not in the repository.

How our applications are built

  • Marketplace applications run on the platform vendor's own infrastructure. We do not operate a server that receives your helpdesk or store data.
  • Outbound requests are addressed to your own account on that platform, and to nothing else.
  • Credentials are stored as platform-managed secure installation parameters. They are attached to requests by the platform, are not returned to the browser, and are not visible to us.
  • Operations that change data require an explicit confirmation, run in bounded batches, and are verified per record.
  • We recommend giving an application a credential with the narrowest permissions that let it do its job.

What we do not claim

We hold no security certification, and no third party has audited our code or our infrastructure. This page describes how the software is built; it is not an assurance report, and we will not describe it as one.