Vulnerability Disclosure Policy

Safe Harbor

Security researchers acting in good faith will not face legal action from Parascope. "Good faith" means:

• No data destruction or modification
• No access beyond what is necessary to demonstrate the vulnerability
• No accessing other customers' data
• Prompt reporting of discovered vulnerabilities

Scope

The following systems are in scope for vulnerability reports:

• All *.parascope.io services
• The collector appliance image

Out of Scope

• Social engineering of Parascope staff or customers
• Physical attacks
• Third-party payment processors, identity providers, and hosting infrastructure
• Denial of service attacks

How to Report

Send vulnerability reports to security@parascope.io. Include:

1. Description of the vulnerability
2. Steps to reproduce
3. Impact assessment
4. Any proof-of-concept code (non-destructive)

Response SLA

Recognition

Researchers who report valid vulnerabilities will be credited in release notes (with consent). No monetary bounties are offered at this time.