Our own security policy

We sell a tool for publishing coordinated vulnerability disclosure policies. It would be embarrassing not to have one.

Reporting a vulnerability in this service

Email [email protected]. We aim to acknowledge within 48 hours and complete triage within 7 days. Good-faith research conducted under this policy is authorised, and we will not pursue legal action over it.

What we ask

Give us a reasonable window before disclosing publicly — 90 days, or sooner once a fix is out.
Work against your own account. Do not access, modify or exfiltrate other customers’ data.
No denial-of-service testing, and no automated scanning that generates significant load.
Stop and tell us immediately if you encounter another customer’s data, and do not retain a copy.

How this service is built

Passwords are hashed with scrypt. Sessions are opaque random identifiers stored server-side, so revocation is immediate. The session cookie is HttpOnly and SameSite=Lax, and Secure in production.

The dependency scanner reads manifests and lockfiles only. It never reads, stores or transmits your source code. Component names and versions are sent to OSV.dev for lookup; nothing else is.

Generated documents are content-addressed by SHA-256 and every generation is recorded in a hash-chained audit trail, which you can export and verify independently of us.

Customers publish their own policies here

If you are looking for the disclosure policy of a manufacturer who uses this service, it will be at /security/their-organisation-name, with a machine-readable security.txt alongside it per RFC 9116. This page covers only CRA Bureau itself.