Security policy
Report a security vulnerability
If you find a security problem in a JetKVM product, tell us privately first. We fix the problem, then publish the details with you.
How to report
- GitHub
Preferred. Open a private report on the affected repository.
- JetKVM
- jetkvm/kvm
- ATX extension
- jetkvm/atx-extension-firmware
- DC extension
- jetkvm/dc-extension-firmware
- JetKVM Cloud
- jetkvm/cloud-api
- Websites
- Use email
Write to [email protected]. Encrypt sensitive details with our OpenPGP key.
- Fingerprint
- 061C 13D3 B358 5443 FEBB 6755 4C75 3D10 CD08 5463
- Key file
- security.asc
- GnuPG
- gpg --locate-keys [email protected]
Include the product and its version, the steps to reproduce the problem, the impact, and a proof of concept if you have one.
Scope
- In scope
- JetKVM
- Firmware and web interface
- Extensions
- ATX and DC firmware
- JetKVM Cloud
- Web app and API
- Websites
- Main site and online shop
- Out of scope
- Denial-of-service attacks and load testing
- Phishing or social engineering of our staff or customers
- Bugs in Shopify, GitHub, Discord, or other services we use
- Scanner reports that show no real impact
What happens after you report
We confirm that we received your report, investigate it, and keep you informed. We close reports that we cannot reproduce or that show no real impact. We agree a disclosure date with you. Please give us a reasonable time to release a fix before you publish.
Recognition
We do not run a bug bounty. With your permission, we credit you in the security advisory and the release notes. We request a CVE only for a vulnerability that we confirm.
Safe harbor
If you act in good faith and follow this policy, we consider your research authorized. We do not take legal action against you or ask law enforcement to investigate you. Test only on devices and accounts that you own or have permission to test. Do not access, change, or keep other people's data, and stop and tell us if you reach it by accident.