Security policy
Reporting a vulnerability
Redoubt is a security product, and we treat vulnerability reports as the highest-priority class of issue. We accept reports from anyone, customer or not.
Machine-readable contact details are at /.well-known/security.txt.
What to include
- The affected component, and the version where you can see one.
- Steps to reproduce, or a proof of concept.
- What an attacker gains.
- A suggested fix, if you have one.
What to expect
These are targets, not guarantees. If a fix needs longer, we will say so, and why.
| Stage | Target |
|---|---|
| Acknowledgement | 3 business days |
| Initial assessment and severity rating | 7 days from acknowledgement |
| Fix or mitigation, critical severity | 14 days |
| Fix or mitigation, high severity | 30 days |
| Fix or mitigation, medium and low severity | 90 days |
Coordinated disclosure
- A 90-day disclosure window by default, negotiable in either direction with the reporter.
- We request CVE identifiers for vulnerabilities in Redoubt itself and publish an advisory alongside the fixed release.
- Affected customers are notified directly. They are never left to notice an advisory on their own.
- Reporters are credited in the advisory unless they prefer otherwise.
- There is no paid bug bounty for the time being, though that may change. What we offer today is fast handling, credit, and a fix.
Safe harbour
Redoubt is a hosted service, so every tenant runs on infrastructure we operate alongside other customers. Testing against the service is testing against them. Good-faith research therefore means:
- No testing against the hosted service or any tenant, including your own, without our written agreement. If you want to test Redoubt, write to us first and we will arrange an environment for it.
- If you come across a vulnerability in the course of ordinary use, stop at the point of discovery and report it. Do not use it to go further.
- Do not access, change or destroy data that is not yours, and do not degrade the service for anyone.
- Give us reasonable time to fix before any public disclosure.
We will not pursue legal action against research that stays within these terms.