SigmaSecSECURITY & DISCLOSURE

Vulnerability Reporting & Defense Standards

Responsible Disclosure Policy

We welcome vulnerability disclosures from researchers working in good faith.

Safe Harbor

We will not initiate legal action against researchers acting in good faith under our guidelines.

Strict Isolation

Never access or alter customer data. Testing must only target your own test accounts and assets.

SLA Response

We acknowledge vulnerability reports within 24 hours and provide regular remediation updates.

01 How to Report a Vulnerability

If you identify a security vulnerability in SigmaSec services, please report it immediately to our security response team:

Email: security@sigmasec.ai

Subject: [VULNERABILITY DISCLOSURE] Short summary

Please include reproduction steps, HTTP requests/responses, and potential impact.

02 In-Scope Domains

*.sigmasec.ai web applications and authentication services.
SigmaSec API backend microservices.
Core scanner adapter worker daemons.

03 Prohibited Testing

The following testing methodologies are strictly out of scope:

Denial of service (DoS / DDoS) attacks.
Spam, phishing, or social engineering targeting SigmaSec employees.
Physical security attacks against hosting facilities.
Modifying or accessing other customers' data.