INCIDENTS · VULNERABILITY DISCLOSURE
Report safely. Preserve the boundary.
Good-faith security research and precise incident reports are welcome. Start with minimum necessary detail so we can establish a safe channel.
- VERSION
- security-v1
- EFFECTIVE
- 30 August 2026
1. Report
Use the contact form and choose a clear security subject. Include the affected Seal of Sigmund URL or component, the observed behavior, date, and a safe reproduction outline. Do not include customer source, credentials, decrypted receipts, personal data, or a live exploit payload in the first message.
2. Immediate triage
Serious security reports are triaged immediately. We will acknowledge the report, establish a safer exchange method if sensitive evidence is required, assess affected tenants and authority boundaries, contain the issue, preserve audit evidence, and communicate material impact.
3. Good-faith research
Limit testing to accounts and repositories you own or have explicit permission to use. Avoid privacy violations, service disruption, social engineering, persistence, data destruction, denial of service, and accessing another customer’s data. Stop and report if an authorization boundary may have been crossed.
4. Disclosure
Allow reasonable time for investigation and remediation before public disclosure. We will not pursue good-faith research that follows this policy, stays within authorization, and avoids harm. This statement cannot authorize activity against third-party systems.
5. Customer incidents
Authenticated customers should use organization support and attach only the job or receipt identifier. If a material incident affects customer data or service authority, notifications will follow applicable contractual and legal duties.