Vulnerability disclosure policy

How to report

Email sebastian@sg-systems.co with a description, the affected component, and steps to reproduce. Encrypt if you prefer; we will exchange keys on request. The same address is published in /.well-known/security.txt.

What we commit to

• Acknowledgement within two business days.
• A named contact and a status update at least every ten business days until resolution.
• No legal action against research conducted in good faith within this policy. We will not pursue someone who helped us.
• Credit, if you want it, once a fix is released.

In scope

• sg-systems.co and its subdomains
• The REMIT console demo hosted on this site
• Our published artifacts: the verifier, SBOMs and build provenance
• The REMIT appliance image supplied to design partners

Out of scope

• Third-party services we link to
• Social engineering of our people or our partners
• Denial of service, and automated scanning of customer deployments
• Findings that require physical access to a customer’s appliance

Please

• Do not access, modify or exfiltrate data that is not yours; use test data.
• Do not degrade service or run automated scanners against customer deployments.
• Give us reasonable time to fix before public disclosure; we aim for ninety days.