How to report
Email the security team with a description of the issue, the steps to reproduce it and what an attacker could do with it. Proof-of-concept code or screenshots help.
Our machine-readable contact file is published at /.well-known/security.txt in the RFC 9116 format.
What happens after you report
Our vulnerability disclosure policy commits us to acknowledging your report within two business days. We then confirm whether we accept it and, if we do, the severity we have assigned. The policy sets a target for fixing each severity:
| Severity | Target to fix | |
|---|---|---|
| Critical | Within 7 days | |
| High | Within 30 days | |
| Medium | Within 90 days | |
| Low | Within 180 days |
What is in scope
The AxisSynapse production application and its API.
A workspace or account that is yours, or one whose owner has given you explicit permission.
Safe harbor
We will not pursue legal action against researchers who act in good faith, stay within the scope above and follow the rules below.
Rules of engagement
- Do not access, change or destroy data that belongs to anyone else.
- Do not degrade the service: no denial-of-service testing, no spam.
- Do not social-engineer our staff or customers.
- Give us reasonable time to fix the issue before you disclose it publicly.