Help us keep Code Guardian and its customers secure.
We welcome clear, good-faith reports about vulnerabilities in Code Guardian systems and products.
Welcome
Security researchers help make our products safer. If you believe you have found a vulnerability, tell us so we can investigate and address it.
Scope
Publicly accessible Code Guardian systems and products are in scope unless we have specifically excluded them. If you are unsure whether a system belongs to us, contact us before continuing.
Safe harbor
Good-faith research performed within this policy is considered authorized. Code Guardian will not initiate legal action solely because of research that follows these guidelines. If a third party takes action related to compliant research, we will make our authorization clear where we reasonably can.
Testing rules
Test only what is necessary to demonstrate the issue. Minimize access to customer and personal data. Do not alter or delete data, establish persistence or move beyond the minimum proof. Stop as soon as a cross-tenant or equivalent authorization failure has been demonstrated. One affected environment is enough to show a tenant-isolation issue.
Prohibited activity
Do not perform DoS or DDoS, intentionally degrade services, send spam, use social engineering, conduct physical attacks, attempt credential stuffing, perform destructive testing or access customer data beyond what is strictly necessary.
Reporting
Email [email protected] with the affected system, a clear description, reproduction steps, expected impact and an optional proof of concept. Please include a safe way for us to contact you.
Response expectations
We aim to acknowledge a report within three business days and provide an initial assessment within ten business days. Complex reports may take longer. We will share useful progress where we can, but we cannot promise a fixed remediation date.
Coordinated disclosure
Please allow reasonable time for investigation and remediation before publishing. We will work with you on an appropriate disclosure timeline. We do not ask for indefinite secrecy.
Recognition
We do not currently offer a bug bounty. When appropriate, and if you want it, we may publicly acknowledge your contribution.