Security
Vulnerability disclosure policy
If you believe you've found a security vulnerability in Monitaria, please tell us privately first. We appreciate the work and will work with you to fix it.
How to report
Email security@monitaria.com. The same address is in /.well-known/security.txt.
Please write in English and include what you need us to reproduce the issue.
- What the vulnerability is and what an attacker could do with it
- The part of the product, and the collector version if it's the collector
- Steps to reproduce it, with requests or a proof of concept
- How you'd like to be credited, if at all
In scope
The collector
The VM appliance and the collector software, tested on a collector you run yourself. A 30-day evaluation is enough.
The hub
app.monitaria.com, tested with your own organization and your own collectors only.
This website
monitaria.com, including Your account, tested with your own organization only.
Testing guidelines
Please
- Test only against collectors, organizations and accounts that are yours
- Stop and tell us as soon as you reach data that isn't yours, and don't keep or share it
- Give us reasonable time to release a fix before you publish anything
Please don't
- Run denial-of-service or load tests, or send spam
- Use social engineering, phishing or physical access
- Scan or test networks or collectors that belong to someone else
What to expect from us
We confirm that we've received your report, keep you informed while we investigate, and tell you when a fix is released. Fixes are published as new releases, and the release notes say when a release fixes a security issue. We credit reporters who want to be credited.
We won't take legal action against research done in good faith that follows this policy.
Read how the product is secured in the security overview.