Security

Vulnerability disclosure policy

Found a security problem in Kandaro? We want to hear about it, we will respond quickly, and we will not take legal action against good-faith research.

Draft. Version 0.1. The safe-harbour wording is under legal review; until then it applies as written below.

How to report

Use the contact form with the topic “Security report”. Reports go straight to our security inbox, urgent ones first. We read English and Dutch.

Describe the affected URL, component or version, the steps to reproduce and the impact.
Leave your contact details so we can follow up.
Don't paste secrets or other people's data into the form. If we need more detail, we arrange a safe channel.

Machine-readable contact details are in our security.txt.

Our commitments

Acknowledge your report: 3 business days
Initial assessment and severity: 10 business days
Fix critical and high issues: 30 days, with updates along the way
Public credit, if you want it: After the fix

There is no paid bug bounty yet; we plan to start one.

In scope

kandaro.com, app.kandaro.com and api.kandaro.com
The Kandaro sensor image ghcr.io/kandaro/sensor and its source code
Our build and release workflows

Out of scope

Customers' networks and their sensors. A deployed sensor is a decoy inside someone else's network. Testing it is testing their network, which you are not authorised to do.
Infrastructure of our suppliers, such as Cloudflare, Stripe and Resend. Report those to them.
Denial of service, spam, social engineering of staff or customers, and physical attacks.
Findings without demonstrated impact: missing best-practice headers, SPF or DMARC on domains that send no mail, rate limits without shown abuse, self-XSS, clickjacking on pages without actions, and unvalidated scanner output.

Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorised, we will not pursue or support legal action against you, and we will work with you to understand and fix the issue.

Good faith means that you:

test only against your own account and the test organisation you created;
stop and report as soon as you can access data that isn't yours, and don't keep, share or change it;
don't degrade the service: no load testing and no spam;
give us reasonable time to fix the issue before you disclose it, by default 90 days, or sooner if we agree.

This policy does not authorise testing of any third party, including our customers.

More about how we protect Kandaro and our customers is on the security page.