Vulnerability disclosure

Report a security issue

A security firm without a published vulnerability disclosure policy is a tell. This is identity rather than compliance: we ask clients to accept reports about their systems from us, so we publish how we accept them about ours.

You do not need to sign a non-disclosure agreement to report a finding, you do not need an account, and you do not need to know anyone here.

Acknowledgement
Acknowledgement within one business day, from a person.
Triage
A triage decision — accepted, duplicate, out of scope, or not a vulnerability — within five business days, with the reasoning.
No NDA, no account
You do not need to sign a non-disclosure agreement to report a finding, you do not need an account, and you do not need to know anyone here.
No legal action
We will not pursue legal action against good-faith research conducted within the scope below, and we will not report you to law enforcement for it. If a third party brings action against you for research we are satisfied was conducted in good faith under this policy, we will say so publicly and in writing.

Read the full vulnerability disclosure policy

Send the report

Include what you did, what happened, and enough detail for us to reproduce it. A reproduction path is worth more than a severity score — we will do the scoring.

Your name or handle (optional)

Optional. Use a handle if you prefer; we will credit whichever you give us, or neither.

Email for the acknowledgement

Required so a person can acknowledge this within one business day and come back to you with the triage decision.

Affected host, URL or endpoint

In scope: envenox.com, its subdomains, and the Envenox engagement platform. Anything belonging to a client is out of scope — report it to them.

What you did, and what happened

A reproduction path is worth more than a severity score. Include the steps, the request, and what came back.

What an attacker could do with it (optional)

Optional. If you stopped at proof of concept — which the policy asks you to — say what you believe the next step would have been rather than taking it.

Credit preference

I tested only accounts I own or have permission to test, and I stopped at proof of concept.

The rules of engagement in the policy. Ticking this is not a legal waiver and it does not transfer anything to us — it tells us the report is good-faith research within scope, which is the condition under which we will not pursue legal action.

Fields marked without “(optional)” are required. We will not share your identity with anyone outside the triage team unless you ask us to.

Or report it directly

The policy names /.well-known/pgp-key.txt as the key location. That key is not published yet, so do not expect a download there — and security.txt deliberately omits the Encryption: field rather than advertising a URL that returns a 404.

If you need to encrypt before you send anything, email the address above asking for a key and we will send one and publish it at that path in the same change. If you would rather not send detail in cleartext in the meantime, send the host and a sentence and we will arrange a channel.

Scope and rules of engagement

Scope

In scope: envenox.com and its subdomains, and the Envenox engagement platform.

Out of scope: anything belonging to a client. If you find something in a client system, report it to them, not to us — and if you cannot identify the owner, tell us and we will try to route it without disclosing who they are.
Out of scope: denial of service, volumetric testing, physical intrusion, and social engineering of our staff or suppliers.
Out of scope: reports generated by a scanner with no manual verification, missing-header findings with no demonstrated impact, and best-practice recommendations without an exploit path. We will read them; we will probably close them as informational, and we will say why.

Rules of engagement

Use only accounts you own or have permission to test. Stop at proof of concept — do not read, modify, exfiltrate or destroy data belonging to anyone else, and do not pivot further than you need to demonstrate the issue. If you access personal data accidentally, stop, tell us, and delete it.

Give us a reasonable period to fix the issue before disclosing publicly. We suggest 90 days and will usually be faster; if we think an issue needs longer we will tell you why and ask rather than assume.

The full policy, including what we will not do