Vulnerability disclosure policy

Scope

This policy covers the SigmaShake products and the services they use: sigmashake.com and its subdomains (accounts, hub, docs, install, voice, showcase), the ssg command-line tool, and the SigmaShake desktop app. It does not cover third-party services that we use. Report those to the vendor.

How to report

Send your report to security@sigmashake.com, or use the vulnerability report form. Include the affected URL or product version, the steps to reproduce, and the impact you see. Our machine-readable contact file is at /.well-known/security.txt (valid until 2027-06-30).

Safe harbor

We will not start legal action against you, and we will not ask a law enforcement agency to do so, for security research that follows this policy in good faith. To stay inside this policy:

• Test only your own accounts and data.
• Do not access, change, or delete data that belongs to other people.
• Do not run denial-of-service, spam, or social-engineering attacks.
• Stop and report right away if you reach personal data or secrets.
• Give us reasonable time to fix the problem before you publish details.

This safe harbor covers SigmaShake systems only. It cannot bind third parties.

Response targets

We acknowledge a report within 24 hours. The patch targets below use CVSS v3.1 severity. They match our CVE response SLA (sigmashake-gov/docs/cve-response-sla.md). The clock starts when your report passes triage.

These are targets, not guarantees.

Rewards

We do not run a paid bounty program.