Vulnerability disclosure policy

Found something? We want to hear about it.

FindingsHub is built for penetration testers, so we expect to be tested. If you have found a security issue in this platform, tell us and we will fix it.

How to report

Email security@sentinel42.com. Include the affected URL or feature, the steps to reproduce, and the impact you can demonstrate. Encrypted mail is welcome — ask and we will exchange keys. Our machine-readable policy is at /.well-known/security.txt.

Our response times

Acknowledgement within 2 working days.
An initial assessment, with our view of severity, within 5 working days.
Regular updates until it is closed, and we will tell you when the fix is live. Critical issues are worked immediately.
Credit in our disclosure list if you want it, and silence if you would rather.

In scope

findingshub.sentinel42.com and its API
The sign-in and authenticator-app flows
Report generation, evidence upload and download
Data segregation between firms, between clients and between roles

Out of scope

Denial of service, volumetric or stress testing of any kind
Social engineering of Sentinel42 staff or our customers
Physical attacks against Sentinel42 or its suppliers
Findings from automated scanners with no demonstrated impact
Missing headers or configuration weaknesses with no exploitable consequence
Third-party services we do not operate
Any testing that touches real customer data — ask us for a test account instead

Safe harbour

If you act in good faith, stay within the scope above, avoid accessing or altering data that is not yours, stop as soon as you have demonstrated the issue, and give us a reasonable chance to fix it before going public, we will not pursue legal action against you and we will not ask your employer to. If you are unsure whether something is in scope, ask first.

No bounty, and we say so plainly

We do not currently run a paid bounty programme. We will credit you, we will fix it, and we will tell you what we did. If that changes we will say so on this page.