01How to report
Email security@eyalsec.com. A person reads every report. It helps us most when you include:
- what the issue is and where: the URL or endpoint, or the agent, its version and the platform;
- clear steps to reproduce it, and a proof of concept if you have one;
- the impact you believe it has, and whether anyone else knows about it;
- how you would like to be credited, if at all.
English or Hebrew are both fine. To encrypt your report, use our OpenPGP key (the fingerprint is beside this text). The same details are in our machine-readable security.txt, signed with that key.
02What is in scope
In scope
- The public site and the dashboard at eyalsec.com and its subdomains
- The agent ingestion and public APIs
- The EyalSec agents as we publish them, es-python and es-chromium among them; Section 1 of the full policy lists each one
- How those agents are installed and delivered
Out of scope
- Third-party services we use, such as our cloud provider: please report those to the provider
- Public issues in open-source components we redistribute unchanged (do tell us if we ship an affected version)
- Findings that need an already-compromised machine, physical access, or a misconfiguration of your own
- Social engineering, physical attacks, and denial-of-service or load testing
- Scanner output with no demonstrated impact, and missing headers with no exploit path
03Safe harbour
If you make a good-faith effort to follow this policy, we consider your research to be:
- Authorized under the Israeli Computers Law, 5755-1995, and comparable computer-misuse laws elsewhere. We will not start or support legal action against you for accidental, good-faith violations of this policy.
- Exempt from anti-circumvention claims. We will not bring a claim against you for working around technology controls in the course of that research.
- Exempt from the restrictions in our Terms of Service and Acceptable Use Policy that would interfere with security research. We waive them, on a limited basis, for work done under this policy, and we will not suspend your account for it.
- Lawful, helpful to the security of the internet, and done in good faith.
You are expected, as always, to comply with applicable law. If a third party brings legal action against you for research that followed this policy, we will make it known that we authorized it.
The safe harbour covers EyalSec’s own systems and software only. It cannot authorize testing of a customer’s systems or anyone else’s, and it does not apply to deliberately taking data that is not yours, to extortion, or to publishing before the coordination period below. Unsure whether something is in bounds? Ask first at security@eyalsec.com; we would much rather answer a question than argue afterwards.
This section follows the disclose.io core terms, an open standard that many security teams use, adapted to Israeli law.
04Testing rules
- Test only your own account, data and installations, never another customer’s. If you need a test account, ask us at security@eyalsec.com.
- Stop as soon as you have proof. Access the minimum needed, and do not keep, change or destroy data that is not yours. If you come across personal data, stop and tell us.
- Keep the service up: no denial-of-service, load or volumetric testing, no spam, and no brute-forcing that affects availability.
- Report promptly and give us a reasonable chance to fix the issue before telling anyone else.
05What we commit to, and by when
| Stage | Our commitment |
|---|---|
| Acknowledgement | Within 3 business days of your report reaching us. |
| First assessment | Within 10 business days: whether we accept it, how severe we think it is, and what we plan to do. |
| Updates | At least every 14 days while the issue is open. |
| Fix | Critical and high severity as fast as we can, targeting 30 days. Medium and low with the next reasonable release. |
| Disclosure | We ask you to keep the issue private for 90 days or until the fix is published, whichever comes first. If we need longer we will say why and agree a date with you. |
We support a CVE where the issue warrants one, and we will never ask you to sign a non-disclosure agreement to report.
06Credit, not cash
We do not run a paid bug bounty, and no money is offered for reports. What we can offer is proper credit: with your permission, your name in the hall of fame and in the advisory for the fix, worded the way you choose. Anonymity is just as fine.
07The full policy
This page is the readable version. The binding text, including how we handle our own vulnerabilities and where to send things that are not security issues, is our Coordinated Vulnerability Disclosure Policy. Where the two ever differ, that policy applies.