Security
Responsible Disclosure
01 Reporting
If you believe you have found a security vulnerability affecting a SenSec public web property, report it to security@sensec.ai with the subject line "Security Disclosure".
Please include a clear description, affected URL or asset, steps to reproduce, potential impact, and any relevant screenshots or proof-of-concept details that do not expose sensitive data.
02 Scope
This policy covers the SenSec corporate website and public web properties operated by SenSec. Product-specific security reporting instructions may be provided separately for individual systems, customer environments, or controlled deployments.
03 Rules of engagement
Do not access, modify, delete, exfiltrate, or disclose data that does not belong to you. Do not perform denial-of-service testing, social engineering, phishing, physical intrusion, spam, automated destructive scanning, or testing against live security operations.
If you encounter sensitive information, stop testing and report the issue immediately. Do not continue exploration beyond what is necessary to demonstrate the vulnerability safely.
04 Safe harbor
We consider security research conducted in good faith and in accordance with this policy to be authorized, and we will not initiate or support legal action, including under the US Computer Fraud and Abuse Act or analogous anti-hacking laws, against such research.
SenSec will not pursue legal action against good-faith security research that stays within this policy, avoids harm, and is reported promptly. This safe harbor does not apply to extortion, data theft, privacy violations, service disruption, or testing outside the stated scope.
05 Response
We aim to acknowledge valid security reports within a reasonable period, assess impact, and remediate based on severity and operational risk. We do not currently operate a public bug bounty program or guarantee monetary rewards.
06 Contact
Security reports: security@sensec.ai.