Vulnerability Disclosure Policy

If you have found a weakness in Nelkira, we want to hear about it, and we would rather hear about it from you than from somebody using it. This page says how to tell us and what we undertake in return.

How to report

Email security@nelkira.com. Please include what you found, how to reproduce it, which version you were using, and what you think an attacker could do with it. A rough note that arrives is worth more than a perfect report that does not.

What we promise

• We will acknowledge you within 3 working days and tell you whether we have reproduced it within 10.
• We will not take legal action against you, or ask anyone else to, for research done in line with this policy and in good faith — including where you accidentally go further than you meant to, provided you stop and tell us.
• We will keep you informed while we fix it, and tell you when the fix ships.
• We will credit you in the release notes if you would like, or keep you anonymous if you prefer.
• We will tell our users. Where a weakness affected people who installedNelkira, we will say so when the fix is out, and say plainly what was at risk.

What we ask

• Give us a reasonable chance to fix it before telling anyone else — 90 days is our expectation, and we will usually be far quicker. If it is already being exploited, tell us that and we will move at once.
• Test against machines you own or have permission to test. Please do not touch other people’s sessions, other people’s machines, or the data of anyone who has not agreed.
• Do not degrade the service for others: no denial-of-service testing against our relays, no mass scanning, no spam.
• If you come across anyone’s personal data, stop, do not keep a copy, and tell us what you saw.

What is in scope

The Nelkira software for all platforms, the relay server software, relays we operate, and this website. Weaknesses in third-party components are in scope for us to co-ordinate even where the fix belongs to someone else.

Out of scope: reports produced by a scanner with no evidence of real impact; missing hardening headers with no exploit path; social engineering of our staff or customers; and the limitations we already publish on the Security Statement, which we know about and have said so.

Rewards

We do not run a paid bounty programme today. If that changes it will be announced here. In the meantime what we can offer is a fast answer, a real fix, and public credit.

Encryption

If you want to send something sensitive, say so in your first email and we will arrange an encrypted channel before you send details.