Vulnerability disclosure
Report a vulnerability in a Threatless system.
Threatless runs an AI-native security ecosystem, and we hold our own systems to the standard we expect of others. If you believe you have found a security vulnerability in a Threatless website or product, we want to hear about it. This page explains what to report, how to report it and what we ask of you while you do.
- In scope
- Threatless websites and products
- Out of scope
- Systems run by our hosting and service providers
- Bug bounty
- Not offered
- Disclosure
- Coordinated: time to investigate and fix before public details
- Channel
- Being established
How to report
The reporting channel.
The dedicated reporting channel is being established.
It will be listed here, and in a security.txt file, as soon as it is monitored. Please do not send vulnerability details through the general enquiry form.
A useful report includes
- 01
What you found
A short description of the issue and the weakness class, if you know it.
- 02
Where
The affected URL, product or component, and the version if relevant.
- 03
How to reproduce it
Step-by-step instructions, with the minimum proof needed to show the issue.
- 04
Impact
What an attacker could do with it, in your assessment.
- 05
How to reach you
So we can ask questions and keep you informed.
What we ask of you
Research in good faith, within limits.
This policy is not an invitation to test systems indiscriminately, and it does not authorize testing of any system you do not own.
- 01
Do no harm to data
Do not access, change or delete data that is not yours. If you encounter someone else’s data, stop and report it. - 02
Stop once confirmed
Use only what is necessary to demonstrate the issue, then stop and report it. - 03
Keep services available
No denial-of-service, load or stress testing, and no automated scanning that degrades service for others. - 04
No people or premises
No social engineering, phishing or physical testing of Threatless staff, offices or partners. - 05
Coordinate disclosure
Give us reasonable time to investigate and fix before sharing details publicly. - 06
Third parties are out of scope
Systems run by our hosting and service providers belong to them. Report issues in those systems to the provider directly.
What to expect
Commitments we can keep.
How quickly will you respond?
Acknowledgement and response timeframes will be published together with the reporting channel, once they can be met reliably. We do not publish commitments we cannot keep.
Do you offer a bug bounty?
This policy does not include a bug bounty or rewards for reports.
Do you provide legal safe harbor?
Safe-harbor language will be added only after legal review. Until then, please follow this policy closely and contact us before doing anything you are unsure about.
My own account was compromised. Is this the right place?
No. This policy is for vulnerabilities in Threatless systems. For help with your own accounts, see personal security help.
I received a suspicious message claiming to be from Threatless.
Threatless will never ask for your passwords, one-time codes or payment by gift card or cryptocurrency. Do not respond to it; report it to your email provider.
Need help with your own accounts? See personal security help.
This website
How this site is built.
Facts about this website, offered for transparency. No website can be guaranteed free of vulnerabilities, which is why this policy exists.
- 01
Static by default
Pages are prerendered. The only dynamic endpoint accepts enquiries, with validation, size limits and rate limiting. - 02
Strict content security policy
Inline scripts run only when they match a cryptographic hash computed at build time, and other scripts only from this site. Trusted Types guard DOM injection sinks. - 03
No third-party scripts
No analytics, advertising or tracking scripts are loaded, and the site sets no cookies. - 04
Isolated from products
The website has no connection to Threatless product systems, customer data or assessment infrastructure.