PhronIQ builds security and infrastructure products, so we take reports about our own systems seriously. This page says how to reach us and what to expect. It is a target, not a contract.
Reporting a vulnerability
Email security@phron.tech. Please do not open a public issue for a security problem.
Include what you were testing (this website, or a named PhronIQ product and version), steps to reproduce, and the impact you observed. A proof of concept helps; a working exploit is not required.
What to expect
| Step | Target |
|---|---|
| We acknowledge your report | within 3 business days |
| We give you an initial assessment and severity | within 10 business days |
| Fix or mitigation for critical severity | within 30 days |
| Fix or mitigation for high severity | within 60 days |
These are targets, not guarantees. We will tell you if we expect to miss one. We do not run a paid bounty programme.
Reporting an incident
If you are reporting an active security incident affecting a PhronIQ-hosted service, use the same address and mark the message urgent. We acknowledge best-effort within the window above.
Scope
This page covers the company website and a company-level contact. Each product publishes its own policy and
supported-version window — for example the Web Application Firewall and
Enterprise Service Bus ship a SECURITY.md with their releases, and
Teichion publishes its policy on its own site. Report product-specific
issues against that product’s policy so the report reaches the team that owns the code.
Coordinated disclosure
We ask for 90 days from your report before public disclosure, or until a fix is released, whichever is sooner. We will credit you unless you prefer otherwise.
Safe harbour
If you act in good faith, test only systems you own or are authorised to test, avoid privacy violations and service disruption, and give us reasonable time to respond, PhronIQ will not pursue legal action against you for your research. This does not cover testing other people’s deployments of our products without their consent.