Reporting a security vulnerability

Cirros Document Solutions Ltd welcomes reports of suspected security vulnerabilities in our products, services and websites. We are committed to working with the security community to keep our customers safe.

How to report

Please email security@cirros.net with:

• A description of the vulnerability and its potential impact
• The affected product, service or URL
• Clear steps to reproduce the issue

Our commitment

• We will acknowledge your report within 2 business days.
• We will provide a status update within 10 business days.
• We will work to remediate confirmed vulnerabilities promptly, prioritised by severity, and keep you informed of progress.

Safe harbour

We will not pursue legal action against researchers who act in good faith and who:

• Make every effort to avoid privacy violations, data destruction, and interruption or degradation of our services;
• Only access, store or disclose the minimum data necessary to demonstrate a vulnerability;
• Give us a reasonable opportunity to remediate before any public disclosure.

Please do not

• Access, modify or delete data that does not belong to you;
• Perform denial-of-service testing or send spam;
• Use social engineering, phishing, or physical attacks against our staff or infrastructure.

Scope: cirros.net and Cirros product services. This is a coordinated disclosure programme; we do not currently offer monetary rewards.

Machine-readable contact details are also published at /.well-known/security.txt.