Security

Our commitments

• Where to report — security@falkyra.com — a mailbox on the product's own domain, in the owner's Google Workspace, which the owner agreed to create and to monitor.
• First reply — within 5 business days, from a person — a first reply from a person within five business days — a commitment the owner made knowing it includes holidays and incidents.
• Safe harbour — yes: the owner undertakes not to take or support legal action against good-faith research within the rules, and to say the research was authorised if a third party does.
• Rewards — no paid bounty programme: no paid bounty programme for now, said plainly so nobody is surprised; revisited with item 41's commercial questions.

The same contact is published in machine-readable form at /.well-known/security.txt (RFC 9116). Please include what you found, where, the steps to reproduce it, and what you think the impact is; a request and response pair is more useful than a long description.

What you may test

• the Falkyra console and its API on this product's own hostnames — we run it, we own the data in it, and a flaw there is ours to fix
• the container images this project publishes — they are public artefacts; anybody can already pull and inspect them
• this source repository, including its CI workflows and dependency set — a supply-chain defect here reaches every deployment, and the repository is already readable by whoever we have shared it with
• the authentication, tenancy and RLS boundaries, using accounts you control — tenant isolation is the single most consequential property this product has, and item 20's RLS work is the reason it can be tested from a second account rather than against somebody else's

What you must not test

Every item here names somebody other than us who would bear the cost.

• any tenant, asset or scan result that is not yours — a customer's findings describe their unfixed vulnerabilities; reading them to prove you can read them has already caused the harm the report would describe
• the shared demo target, beyond the trial account you were given — `trial.py` confines a trial to the one demo host Falkyra runs, and that host is shared with every other trial user — degrading it is a denial of service against strangers rather than against us
• denial of service, volumetric testing, or resource exhaustion of any kind — the product's own `safe_mode` and request budgets exist because load is the harm a scanner most easily causes, and we are not going to ask researchers to demonstrate it on a live deployment
• social engineering of staff, contractors or customers — the finding would be about a person rather than about the software, and the person did not consent
• physical access, and any third-party service this product merely integrates with — a flaw in a vendor's API is that vendor's to receive under their own policy, and reporting it to us delays the fix
• automated scanning that ignores the published rate limits — it produces noise we cannot triage and load we did not agree to, and it is indistinguishable from an attack in the logs

What happens after you report

1. send the report to the published contact, with enough detail to reproduce it
2. we acknowledge receipt and tell you whether we can reproduce it
3. we agree a disclosure date with you, and we tell you if we need to move it and why
4. we fix it, and we credit you by whatever name you ask for — or not at all, if you prefer
5. we publish what was wrong once a fix is deployed, including when the answer is that we were already wrong about it in public