Vulnerability disclosure policy

Our commitment

Security is what we sell, so we take reports about our own security seriously. If you believe you have found a vulnerability in anything we operate or ship, we want to hear from you, and we will work with you to understand and fix it.

Scope

This policy covers:

• this website, fluencesecurity.com, including the blog and the contact forms;
• other services under the fluencesecurity.com domain that FluenceSecurity operates, such as account.fluencesecurity.com and img.fluencesecurity.com;
• our products XenXDR, AntiBait and Triazer, including their websites. Where a product publishes its own disclosure policy, that policy adds product-specific rules to this one.

Out of scope:

• systems we operate for or inside a client's environment, unless the client has asked you to test them; report those findings to the client;
• third-party services we use, such as Cloudflare; report those to the vendor;
• findings that require physical access to a device, social engineering of our staff or clients, or denial of service;
• missing security headers, version disclosure or similar findings without a demonstrated impact;
• reports produced solely by automated scanners without validation.

Rules of engagement

Please:

• test only against systems in scope, and only as far as you need to;
• stop as soon as you have enough evidence to demonstrate the issue. Do not read, modify or exfiltrate data that is not yours;
• do not degrade or disrupt a service, and do not use automated tools at volume against production systems;
• do not send test submissions through the contact forms beyond a handful needed to show an issue;
• keep the details confidential until we have fixed the issue and agreed on publication;
• do not demand payment as a condition of disclosure.

How to report

Email security@fluencesecurity.com. If you want to encrypt your report, ask us for our current PGP key in a first message. Include:

• what you found and where, with the URL or product version;
• steps to reproduce, and a proof of concept if you have one;
• the impact as you understand it;
• how you would like to be credited, or that you prefer not to be.

Our security.txt file at /.well-known/security.txt points to this policy.

What you can expect

• An acknowledgement within 2 business days.
• An initial assessment of severity and a first response about our plan within 10 business days.
• Regular updates while we work on a fix, and a note when it ships.
• A fix for confirmed vulnerabilities, prioritised by severity.
• Public credit if you wish.

We do not run a paid bug bounty programme at this time.

Coordinated disclosure

We ask for 90 days from acknowledgement before public disclosure, or until a fix has shipped, whichever comes first. If we need more time, we will explain why and agree a date with you. We will not ask you to withhold disclosure indefinitely.

Safe harbour

If you act in good faith and follow this policy, FluenceSecurity will not pursue legal action against you for your research, will not report you to law enforcement for it, and will consider your activity authorised for the purposes of the Polish Penal Code provisions on unauthorised access and of similar laws in other jurisdictions, to the extent we are able to. If a third party takes action against you for research covered by this policy, we will make it known that you acted with our authorisation. This safe harbour does not cover actions that go beyond the rules above.

Changes

We may update this policy as the programme matures. The version and date at the top identify the current text.