Security
Report a vulnerability.
If you believe you have found a security problem in Trustwelt or in Vault Lite, we want to hear about it, and we will work with you to fix it before anything is made public.
How to report
Send your report by email.
Email security@trustwelt.com. Our contact details are also published in /.well-known/security.txt. Do not use the general contact form for vulnerabilities. For Vault Lite, private vulnerability reporting on GitHub reaches the same people.
Please include:
- the product or address affected, and the version if you know it;
- the steps to reproduce, and what you expected instead;
- the impact you believe it has;
- how you would like to be credited, if at all.
Our commitment
We acknowledge every report within three working days, keep you informed while we work on it, and credit you in the advisory if you wish.
Research rules
Test in good faith.
- Use only accounts and data you own or have permission to use.
- Do not access, change or delete other people's data. Stop and report as soon as you see any.
- No denial-of-service, spam or social engineering of our staff or customers.
- Give us reasonable time to fix the issue before you disclose it.
Research that follows these rules is welcome. We will not pursue or support legal action against you for it.
Scope
What is in scope.
- trustwelt.com and portal.trustwelt.com
- Organisation admin hosts under admin.trustwelt.com
- The Trustwelt agent, the sync service, and the Vault Lite desktop app and browser extension
Out of scope: reports from automated scanners without a demonstrated impact, and missing best-practice headers with no exploit.
What happens next
From report to fix.
Acknowledge
We confirm we received your report, within three working days.
Triage
We reproduce it and rate its severity.
Fix
We fix it, sign the release and ship it.
Notify
We tell affected customers what they need to do.
Disclose
We publish an advisory, with a CVE where it applies, and credit you if you wish.
Not a vulnerability?
For sales, deployment or general questions, use the contact page.