Security
Responsible disclosure policy
Think you have found a flaw in the website, the console or a Kayzen agent? Thank you. Here is how to report it and what we commit to doing.
How to report
Write to the address given in our security.txt file, stating the component concerned, the steps to reproduce and the estimated impact. Do not send any third-party personal data.
Scope
The public website, the console, the agents and the cloud services of Kayzen Security. Our providers' services are covered by their own policy.
Good-faith rules
No access to other people's data beyond what is strictly necessary to demonstrate the issue, no denial of service, no social engineering, no publication before a fix or agreement.
Our commitments
Acknowledgement within 5 business days, assessment and regular updates on the handling, public thanks if you wish; we will not file a complaint or take any action against research carried out in good faith within this framework.
Publication timeline
We ask for a reasonable time to fix the issue, in principle 90 days, adjustable by mutual agreement depending on severity.
Rewards
No reward programme is open to date; a public programme is planned for later.