Security Disclosure Policy
We take the security of platform.servgrid.net seriously. If you believe you have found a security vulnerability, please report it to us as described below. We appreciate responsible disclosure.
How to Report
Email: security@servgrid.net
Please include:
- Description of the vulnerability and its potential impact
- Steps to reproduce the issue
- Any proof-of-concept code or screenshots (if applicable)
- Your name/handle (for acknowledgement, if desired)
Our Commitments
- Acknowledge: We will acknowledge your report within 24 hours of receipt and give it a reference.
- Investigate: We will validate the report and assign a preliminary severity within 3 business days, and update you at least every 7 days while it is open.
- Fix: From validation, Critical vulnerabilities (CVSS ≥ 9.0) are fixed or mitigated within 24 hours, High (CVSS 7.0–8.9) within 72 hours, Medium (CVSS 4.0–6.9) within 14 days, and Low in the next quarterly batch.
- Notify: We will notify you when the fix is deployed.
- Credit: With your permission, we will acknowledge your contribution on our acknowledgements page.
Scope
In scope:
- platform.servgrid.net (all subdomains)
- The Service Directory application and its APIs
Out of scope:
- Third-party services (GCP infrastructure, Sentry)
- Denial of service attacks
- Social engineering or phishing of our staff
- Findings from automated scans without accompanying proof of exploitability
Safe Harbour
We will not pursue legal action against researchers who discover and report security vulnerabilities in good faith, provided they:
- Do not access, modify, or delete data belonging to other users
- Do not perform denial of service attacks
- Report the vulnerability to us before public disclosure
- Give us reasonable time to address the issue before disclosure