Trust · responsible disclosure
Report a vulnerability
If you think you have found a security problem in SiteOS or this website, please tell us before anyone else. We will work with you to understand and fix it.
Draft, pending legal review. The commitments on this page take effect once the review is complete.
How to report
Use the briefing request form and choose Security report as the topic.
Keep the first message short: what is affected, the kind of problem and how to reach you. Leave out exploit code and any data you obtained. We will reply to arrange a secure way to share the details.
No encryption key yet
We do not have a PGP key yet, so we cannot accept encrypted email and our security.txt is not signed. When we publish a key, it will be listed in security.txt and on this page.
In scope
- The SiteOS web application and its API, in a version we currently ship.
- This website.
- The air-gapped install bundle and the attestation verifier, once published.
Out of scope
- A customer's own installation, network or hardware. Report those to the customer.
- Third-party services and devices that SiteOS connects to.
- Denial of service, spam, social engineering and physical attacks.
- Reports from automated scanners with no demonstrated impact.
While you test
- Only test against accounts and data you own, or that we have agreed in writing you may use.
- Stop as soon as you reach data that is not yours, and do not keep, share or change it.
- Do not degrade the service for other people.
- Give us a reasonable time to fix the problem before you talk about it publicly.
What to expect
- We acknowledge your report and tell you who is handling it.
- We keep you updated until the problem is fixed or we explain why we will not change anything.
- With your permission, we credit you when we publish the fix.
We do not pay for reports.
Languages
English.