Responsible disclosure

This page is Pentr's vulnerability disclosure policy. It covers how to report a vulnerability, what is in scope, the rules for testing, the legal terms that apply to research carried out under those rules, and the reward.

Reporting a vulnerability¶

Send reports to security@pentr.sh. A report should include:

• the affected component, URL or API route;
• the steps to reproduce the issue, with any requests, payloads or scripts used;
• the impact you observed, and the impact you believe is possible;
• the accounts and organizations you used while testing;
• how you want to be contacted, and the name under which you want to be credited, if any.

One report per vulnerability. A report that chains several issues can describe them together if none of them has an impact on its own.

What happens after a report¶

Step	When
Acknowledgement of receipt	Within 3 days of the report
Initial assessment: whether the issue is accepted, its severity, and the next steps	Within 7 days of the report
Status updates	When the status changes, until the issue is fixed or closed
Notice that the fix is deployed	When it is deployed

If Pentr does not accept a report as a vulnerability, the assessment gives the reason.

Scope¶

In scope:

• the Pentr console and its sign-in and account flows;
• the partner API under /api/v1, including API keys and webhooks;
• evidence locker share links and locker downloads;
• pentr-verify and the locker format: any way to make a locker that was altered after sealing, or not sealed by the organization's key, pass verification;
• the run container and the scope guard: any way for a run to reach a target outside its engagement's scope, to act outside its container, or to read another organization's data;
• the separation between organizations described in Isolation and Authorization;
• the pentr.sh website.

Out of scope:

• the systems of Pentr's subprocessors. Report issues in those systems to the provider concerned;
• denial-of-service and volumetric testing;
• social engineering of Pentr staff or customers, and physical attacks;
• findings from automated scanners submitted without a demonstrated impact;
• missing security headers, cookie flags or email authentication records (SPF, DKIM, DMARC) without a demonstrated impact;
• clickjacking on pages that have no state-changing action;
• vulnerabilities that require a compromised device or browser.

Rules for testing¶

• Test only with accounts and organizations you created. Do not access, change or delete data belonging to another organization or user.
• Run engagements only against assets you own. Pentr requires ownership proof before a run starts; Ownership verification describes it. Do not use Pentr to test a system you are not authorized to test.
• If you reach data that is not yours, stop, do not copy or keep it beyond what the report needs to show the issue, and report it immediately.
• Use the minimum access needed to show the issue. Do not create persistence, move laterally, or escalate further once the issue is shown.
• Keep automated testing at a rate that does not degrade the service for other users.
• Do not disclose the issue to anyone else until Pentr has deployed a fix, or until 90 days after the report, whichever comes first. The date can be changed by agreement in either direction.

Safe harbour¶

Research carried out in good faith and in line with the rules on this page is treated by Pentr as authorized. For such research, Pentr:

• will not bring civil or criminal proceedings against you, and will not file a complaint with the authorities;
• will not treat it as a breach of Pentr's terms of service, including terms that restrict reverse engineering or automated access, to the extent the research needed it;
• will state, if a third party brings proceedings against you over the research, that it was authorized under this policy.

Authorization under this policy is Pentr's consent, as owner and operator of the systems in scope, for the purposes of the offences on unauthorized access and interference with information systems in Directive 2013/40/EU and the national laws that implement it. It covers only systems that Pentr owns or operates. It does not cover the systems of subprocessors, customers or other third parties, and Pentr cannot give consent on their behalf.

Personal data you encounter while testing is subject to the General Data Protection Regulation (Regulation (EU) 2016/679). Process it only as far as the report needs, do not share it, and delete it once the report is closed. Pentr, as controller, handles any notification that a report requires under that regulation.

This policy follows the coordinated vulnerability disclosure practice that Article 12 of Directive (EU) 2022/2555 (NIS2) describes. You can also report a vulnerability through the national CSIRT designated under that article, which acts as an intermediary with Pentr.

Safe harbour does not apply to research that breaks the rules on this page, to extortion or a demand for payment as a condition of disclosure, or to data obtained and kept beyond what the report needed. If you are unsure whether an action is covered, ask at security@pentr.sh before taking it.

Reward¶

The first person to report a vulnerability that Pentr accepts receives one month of Pentr service at no charge. A reporter who is already a customer can give the month to another person or organization instead.

Reporters are credited when the fix is announced, under the name they give, unless they ask not to be.