Vulnerability Disclosure Policy

Field	Value
Document ID	SILUX-POL-021
Version	1.0
Effective Date	2026-05-08
Owner	Security
Review Cadence	Annual
Classification	Public
Licence	CC-BY-4.0 (template adapted from disclose.io)

Revision History

Version	Date	Author	Summary
1.0	2026-05-08	Security	Initial publication.

Brand Promise

Keeping our users' data safe is our highest priority. We welcome the contributions of external security researchers and look forward to working with you.

Scope

In scope:

• All sub-domains of siluxconnect.com (production tenants *.app.siluxconnect.com, marketing site, status page).
• The Silux Connect agent (open-source, AGPL-3.0).
• The Flutter desktop and mobile clients distributed via our website and app stores.
• Container images published to ghcr.io/silux-connect/.
• The Silux Relay protocol implementation.

Out of scope:

• Denial-of-service tests against shared infrastructure.
• Social engineering of Silux personnel, customers, or end users.
• Physical attacks against Silux facilities or staff.
• Vulnerabilities in third-party SaaS we use (please report directly to the vendor).
• Findings that require physical access to a victim's device.
• Self-XSS without an attacker-controlled vector.
• Best-practice issues without a demonstrable security impact (e.g., missing security headers on marketing pages).

How to report

Submit reports through one of the following channels:

• HackerOne: https://hackerone.com/silux-connect (preferred, encrypted, two-way conversation)
• Email: security@siluxconnect.com (PGP key at /.well-known/openpgpkey/dpo)
• security.txt: machine-readable contact at /.well-known/security.txt

Please include:

• A description of the issue and its impact.
• Step-by-step reproduction or a proof of concept.
• The version, build, or commit you tested.
• Whether the issue is being publicly discussed elsewhere.
• Whether you would like credit, and how you would like to be credited.

Our commitments

When you report a vulnerability in good faith and following this policy, we commit to:

1. Acknowledge receipt within one business day.
2. Provide an initial triage within five business days.
3. Update you at least every ten business days until resolution.
4. Work with you on coordinated public disclosure, on a timeline appropriate to the severity (typically 90 days for critical/high; sooner if mutually agreed).
5. Add your name to the Hall of Fame at /security#hall-of-fame, unless you prefer to remain anonymous.
6. Pay a bounty according to the published bounty table in the HackerOne program.

Safe harbour

We will not initiate or support legal action against researchers for security research and vulnerability disclosure activities that comply with this policy.

We consider security research conducted under this policy to be:

• Authorised under the Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act 1990, and equivalent statutes; we waive any claim against you under those laws.
• Exempt from the anti-circumvention provisions of the DMCA (17 U.S.C. § 1201) and the EU Copyright Directive (Art. 6) for the purposes of good-faith research.
• Lawful, helpful, and conducted in good faith.

If a third party initiates legal action against you for activities conducted in compliance with this policy, we will make our authorisation known.

Researcher rules of engagement

To remain in scope and protected by safe harbour, you must:

• Make a good-faith effort to avoid privacy violations, destruction of data, and degradation of service.
• Use only the test accounts you have created for the purpose, or accounts you own. Do not access, modify, or delete data of other tenants or other users.
• Stop testing the moment you encounter user data that is not yours, and report what you found.
• Do not exfiltrate, retain, or share Customer Data beyond what is necessary to demonstrate the vulnerability.
• Give us reasonable time to remediate before public disclosure.
• Comply with applicable law.

Bounty table (summary)

Severity	Range (USD)
Critical	8,000 — 25,000
High	2,000 — 8,000
Medium	500 — 2,000
Low	100 — 500

Multipliers apply for exceptional reports. Final amounts are at the discretion of the security team based on real-world impact and report quality.

Hall of Fame

Researchers who have responsibly disclosed valid findings appear at /security#hall-of-fame with their consent.

Contact

• Security team: security@siluxconnect.com
• HackerOne: https://hackerone.com/silux-connect
• Postal: Silux Connect, Attn: Security — registered address on file with UK Companies House

This policy is published under the Creative Commons Attribution 4.0 licence. Adapted from the disclose.io core terms.