Vulnerability disclosure policy
We want to hear about security problems in Phosigil before anyone else does. This policy tells researchers and customers how to report one, what to expect from us, and what we promise in return.
Scope
In scope
- The Phosigil product: the backend, the web app, the installers and update tooling, the Outlook and Gmail report add-ins, and the shipped content library's rendering paths.
- Phosigil's hosted services:
gateway.phosigil.com(managed gateway, update and content channel, licence check-in) andvendor.phosigil.com(vendor console). - This website, phosigil.com.
- Phosigil's own demo or staging instances when they are clearly labelled as such.
Out of scope
- Customers' own Phosigil installations and the data in them. Report issues you find there to that organisation; do not test against an installation you are not authorised to test.
- Phishing-simulation emails, SMS, calls, landing pages and look-alike domains are the product working as designed; they are not vulnerabilities.
- Findings that require physical access, social engineering of Phosigil staff, or denial of service.
- Missing best-practice headers, SPF or DMARC records on non-mail domains, version disclosure, or automated-scanner output without a demonstrated impact.
- Third-party services we use (listed on the security page); report those to the vendor concerned.
How to report
Email [email protected] with:
- the product version or host name affected;
- steps to reproduce, a proof of concept, or the request and response;
- the impact as you understand it;
- whether you want to be credited, and under what name.
If you need to send sensitive detail encrypted, ask us for a key at the address above and we will reply with one. Please do not open a public issue, post exploit detail, or contact customers directly.
What we will do
| Step | Our commitment |
|---|---|
| Acknowledge | Within 3 business days of receipt |
| Triage and first assessment | Within 10 business days, including an initial severity rating and whether we consider it in scope |
| Keep you updated | At least every 14 days while the issue is open |
| Fix and release | Target within 90 days of the report; sooner for critical issues. Fixes ship as signed releases through the normal update channel and are noted in the changelog |
| Credit | With your consent, in the release notes and on this page |
Coordinated disclosure
We ask that you give us 90 days from your report before publishing details. If we need more time (for example a fix that requires customers to migrate data) we will tell you why and agree a new date. If we have shipped a fix earlier, you are free to publish once the fix has been available for 14 days, so that customers have had a chance to update. We will not ask you to sign an NDA or keep an issue secret indefinitely.
Safe harbour
If you make a good-faith effort to comply with this policy while researching a system in scope:
- we will consider your research authorised under the Computer Fraud and Abuse Act and similar laws, and will not initiate or support legal action against you for it;
- we will consider it exempt from the anti-circumvention provisions of the DMCA and will not bring a claim for circumvention of technology controls;
- we will consider it lawful and helpful, and will work with you to understand and resolve the issue quickly;
- if a third party initiates legal action against you for activity conducted in accordance with this policy, we will make it known that your actions were authorised.
Good faith means: you access only what is needed to demonstrate the issue, you do not alter, destroy or exfiltrate data beyond a minimal proof, you stop and report immediately if you encounter personal data (ours or a customer's), you do not degrade the service for others, and you do not exploit the issue beyond the proof of concept.
Rewards
We do not run a paid bug-bounty programme at this time. We thank researchers publicly with their consent.
Customers
Customers with a support agreement should use their support channel for security questions; security reports should follow this policy so they reach the engineering owner directly. We notify customers of security fixes through the signed update channel and the changelog, and will contact affected customers directly for critical issues.