AnnouncementMeet ASTPP at Africa Tech Festival 2026 in Cape Town!Book a Meeting

Reporting a security vulnerability

The ASTPP team and community take security seriously. ASTPP is carrier-grade billing and switching software, and we depend on responsible researchers and operators to help keep it secure. We appreciate your efforts and will work with you through confirmation, fixing, and public credit.

How to report

Report security issues privately, never through public GitHub issues or the community forum.

Email: [email protected]

Or use GitHub private vulnerability reporting in the Security tab of https://github.com/inextrix/ASTPP

What to include

Please include at least:

  • Your name and contact details, and how you would like to be credited
  • A clear description of the vulnerability and its impact
  • The affected ASTPP version or commit
  • Steps to reproduce, and proof-of-concept material where possible (request/response examples, scripts, sample captures)
  • Any disclosure plans or deadlines you have

Scope

In scope:

Out of scope:

  • Deployments you do not own. Only ever test against your own installation.
  • Third-party dependencies (for example FreeSWITCH, PHP, the operating system). Please report those to their respective projects.
  • The community forum and other third-party platforms we use.
  • Issues that require physical access, social engineering, or targeting of ASTPP users, Inextrix staff, or customers.
  • Denial-of-service testing against any live system.

Rules of engagement

  • Test only against installations you own and control.
  • Do not access, modify, or destroy data that is not yours.
  • Do not run denial-of-service attacks, brute-force attacks, or spam.
  • Do not target Inextrix staff, customers, or their users.
  • Give us a reasonable opportunity to fix the issue before any public disclosure.

If you follow these guidelines in good faith, we will treat your research as authorised and will not pursue or support legal action against you in relation to it.

Our process and timelines

  • We aim to acknowledge your report within 5 working days.
  • We will confirm the issue and keep you updated as we work on a fix.
  • We follow coordinated disclosure: we will agree a public disclosure date with you, aligned with the release that fixes the issue.
  • Where appropriate, we request a CVE for the issue and publish a security advisory through GitHub.
  • If a report has not been addressed within 3 months, you are welcome to follow up at [email protected].

Recognition

We do not run a paid bug-bounty program. We recognise valid reports by crediting researchers in our release notes, in the published security advisory, and on our security acknowledgements page, in the way each researcher prefers. We are grateful for the time and skill involved in responsible disclosure.

Known vulnerabilities

For a list of CVEs that have been fixed in ASTPP, see our advisories page: https://github.com/inextrix/ASTPP/security/advisories