Security and Vulnerability Disclosure

In scope

• The 3AM software: its installer, container images, Helm chart, console, API, packs and licence checks, in a version we still support;
• warden.3am.si and get.3am.si;
• 3am.si and docs.3am.si.

Out of scope: issues in third-party services we use (report those to the provider), findings that need a compromised device or physical access, missing best-practice headers with no demonstrated impact, social engineering, and volumetric denial of service.

How to report

Email [email protected] with what you found, how to reproduce it, the version or URL, and its impact as you see it. Please don't include customer data. We don't run a paid bug bounty today, but we'll credit you, with your permission, when we publish a fix.

What we promise

• to acknowledge your report within 3 business days;
• to tell you whether we confirm it, and how severe we think it is, within 10 business days;
• to keep you informed until it's fixed, and to agree a disclosure date with you, normally within 90 days of your report;
• to tell affected customers and publish security updates as fixes are released.

Rules for testing

• Test only against your own installation of 3AM, or accounts and trials you are entitled to use. Never test against a customer's installation.
• Don't access, change or delete data that isn't yours; if you reach any, stop, and tell us.
• Don't degrade our services: no denial of service, spam, or automated scanning of Warden beyond what's needed to show the issue.
• Don't publicly disclose the issue before we've agreed a date.

Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised, we won't pursue or support legal action against you for it, including under anti-hacking or anti-circumvention laws or our terms, and if a third party takes action against you, we'll make it known that you acted under this policy. This doesn't authorise breaking any law, or affect the rights of third parties we don't control.