Responsible Disclosure Policy
Being a security firm doesn't make us immune to vulnerabilities. If you have found one in our systems, please let us know. We value working with researchers acting in good faith.
Scope
- www.ilredosentinel.com and its subdomains
- Software developed by ILREDO Sentinel
Please report vulnerabilities in third-party services, such as our hosting, email or domain providers, directly to the provider concerned.
How to report
Send your finding to [email protected] with “Security report” in the subject line. Our machine-readable contact details are published in our security.txt file.
Please include:
- The affected URL or component
- The type of vulnerability and its potential impact
- Steps to reproduce or a proof of concept
- How we can reach you, and whether you would like to be credited
Our commitments
- We will respond to your report within 5 business days at the latest.
- We will keep you informed about the assessment and remediation.
- We ask you not to disclose the issue publicly before it is fixed, and we will agree a publication date with you.
- If you wish, we will credit you on this page.
We don't currently run a paid bug bounty programme.
Safe harbour
We will not take legal action against research carried out in good faith and in line with this policy. To qualify:
- Use only the minimum access needed to demonstrate the vulnerability.
- Don't modify, delete, download or share data with third parties.
- Avoid tests that could disrupt the service.
- If you encounter personal data, stop testing and notify us immediately.
Out of scope
- Denial-of-service (DoS/DDoS) testing
- Social engineering, phishing and physical testing
- High-volume automated scanning
- Reports of missing headers or version disclosure without a demonstrated security impact
Acknowledgements
No reports have been received yet. We look forward to thanking the first researcher to submit a responsible disclosure here.
Last updated: