Security
If you find a security problem in a JetKVM product, tell us privately first. We fix the problem, then publish the details with you.
Updated
Report on GitHub
Preferred. Open a private report on the affected repository. For the websites, use email.
Report by email
Encrypt sensitive details with our OpenPGP key.
Or fetch the key with GnuPG:
gpg --locate-keys security@jetkvm.comWhat to include
The product and its version, the steps to reproduce the problem, the impact, and a proof of concept if you have one.
Scope
In scope
- JetKVM firmware and web interface
- ATX and DC extension firmware
- JetKVM Cloud web app and API
- The main site and the online shop
Out of scope
- Denial-of-service attacks and load testing
- Phishing or social engineering of our staff or customers
- Bugs in Shopify, GitHub, Discord, or other services we use
- Scanner reports that show no real impact
After you report
We confirm that we received your report, investigate it, and keep you informed. We close reports that we cannot reproduce or that show no real impact. We agree a disclosure date with you. Please give us a reasonable time to release a fix before you publish.
Recognition
We do not run a bug bounty. With your permission, we credit you in the security advisory and the release notes. We request a CVE only for a vulnerability that we confirm.
Safe harbor
If you act in good faith and follow this policy, we consider your research authorized. We do not take legal action against you or ask law enforcement to investigate you. Test only on devices and accounts that you own or have permission to test. Do not access, change, or keep other people's data, and stop and tell us if you reach it by accident.