AFLINK / SECURITY
Security and responsible disclosure
Security is part of the Aflink architecture. This page describes product controls and how to report concerns, not a claim of independent certification or immunity to attacks.
Identity and permissions
User sign-in is delegated to CIATTO Account. Merchant operations require membership and role checks. MCP access uses scoped OAuth tokens, not website passwords pasted into an AI chat.
Integrations and auditability
SaaS events are authenticated with signed requests and idempotency controls. Application secrets belong only on trusted backends. The commission ledger records corrections and reversals rather than hiding them.
Report a vulnerability
Send a concise private report with steps to reproduce, affected URL and potential impact to [email protected]. Do not publish secrets, exploit accounts belonging to others, access unnecessary personal data or perform denial-of-service tests.
Boundaries
Avoid claiming formal security compliance badges or financial guarantees without independent evidence. Program payouts may involve additional manual review.