admin
00982f027d
Adds a private/proprietary license notice matching the convention used in top0, and a vulnerability-disclosure policy with contact, scope, and response-time expectations. No code changes.
1.9 KiB
Security Policy
0pt (SIAX Core Platform: Data OS) is proprietary software operated by SIAX Technology AB. This document explains how to report a suspected security vulnerability.
Reporting a vulnerability
Do not open a public GitHub issue for a suspected security problem.
Email: security@siax.io (fallback: simon@siax.io)
Include, if possible:
- A description of the issue and the impact you believe it has.
- Steps to reproduce, or a proof-of-concept request/response.
- The route, endpoint, or component affected.
- Whether the issue is already publicly known or exploited.
Response expectations
- Acknowledgement: within 2 business days.
- Initial triage and severity assessment: within 5 business days.
- Remediation timeline: communicated after triage, based on severity. Confirmed high/critical issues are prioritized ahead of other work.
We will keep you informed of progress until the report is resolved and, where appropriate, credit you in internal release notes (no public bug bounty program exists at this time).
Scope
In scope:
- The 0pt application and its API routes at 0pt.app.
- The 0pt engine/orchestrator services in this repository.
- Infrastructure-as-code and CI/CD configuration in this repository.
Out of scope:
- Third-party services and dependencies not maintained in this repository (report those to the respective vendor).
- Denial-of-service testing, spam, or social engineering against SIAX staff or customers.
- Automated scanning that generates excessive load against production systems without prior coordination.
Some known findings (for example authentication gaps on specific internal API routes) are already tracked internally and pending an intentional, reviewed fix; reporting them is still welcome and helps confirm priority.
Disclosure
Please give us a reasonable opportunity to investigate and remediate an issue before any public disclosure. We aim to coordinate disclosure timing with reporters wherever possible.