Report a vulnerability
If you find a security issue in Tracix, tell us privately and give us the chance to fix it before anyone else learns about it.
How to report
Send us a private report
Email [Security contact email]. Please do not open a public issue or post details anywhere else.
What to include
What is affected
The host, product or component, such as a workspace address or a collector version.
How to reproduce it
The steps, requests or proof of concept that show the problem.
The impact
What someone could do by exploiting it.
How to reach you
So we can ask questions and tell you when it is fixed.
What to expect
What happens after you report
- 01We confirm receiptWe tell you we have your report within [Acknowledgement target].
- 02We investigateWe reproduce the issue, assess its impact and keep you updated as we work.
- 03We fix itCritical issues within [Fix target for critical issues], and everything else by severity.
- 04We disclose togetherOnce the fix is out, we agree with you when and how the details are published.
Guidelines
Scope, rules and safe harbor
In scope
The console at cloud.tracix.io, workspaces at *.app.tracix.io, the Tracix Collector and its installers at charts.tracix.io, and this website.
Out of scope
Denial of service, social engineering, physical attacks, and reports from automated scanners without a demonstrated impact.
Test only what you own
Use your own workspace. Do not access, change or delete anyone else's data; if you reach it by accident, stop and tell us.
Keep it private
Do not share details publicly until we have released a fix and agreed a date with you.
Safe harbor
[Safe-harbor wording, provided by legal]