Skip to content
Security

Responsible Disclosure

If you believe you have found a security vulnerability in SentinelPanda, this page tells you what is in scope, how to report it, what you can expect from us, and the safe-harbour commitments that protect good-faith research.

Scope

In scope:

  • app.sentinelpanda.com — the application and its API.
  • sentinelpanda.com — the marketing site.
  • Mobile or desktop clients distributed under the SentinelPanda name (none currently published).

Out of scope:

  • Denial-of-service attacks, traffic flooding, or rate-limit testing.
  • Social engineering of our staff, customers, or partners.
  • Physical attacks against our offices, data centres, or staff.
  • Findings already disclosed publicly or already known to us.
  • Issues in third-party software not maintained by us, unless the integration itself is the vulnerable surface.

How to report

Email security@sentinelpanda.com with the details. PGP-signed mail is welcome; the key is referenced in /.well-known/security.txt. Please include:

  • A clear description of the issue and the impact.
  • Step-by-step reproduction with the minimum proof-of-concept needed.
  • Any logs, requests, or screenshots that help us verify.
  • Your preferred name (or pseudonym) for the optional acknowledgements list.

What you can expect

  • An acknowledgement within 2 business days.
  • A triage decision and severity rating within 5 business days.
  • Status updates at least every 14 days while the issue is open.
  • Notification when the issue is resolved and (if you want) a credit in the acknowledgements list.

Safe harbour

We will not pursue civil or criminal action against good-faith research conducted within this policy. "Good faith" means: report through the channel above, do not access or modify data that is not your own, do not impact the availability of the service, give us a reasonable time to respond, and follow any specific guidance in this page.

Acknowledgements

Researchers who have reported issues under this policy will be listed here, with their consent. The list is empty at the time of publishing; it will not stay that way.