Responsible Disclosure Program
Reporting a Vulnerability
Please use the following dedicated channel for all security-related concerns:
- Email: vulnerability@eudia.com
- Subject: Security Vulnerability Report
- Body: Describe the nature of the vulnerability in detail, including the steps to reproduce it if possible. Please include any relevant information that would help us understand the severity and scope of the issue, such as the potential impact on user data or system integrity.
Anonymous reports are welcome. Providing your name or contact information is optional. If you do not provide a way to contact you, we cannot acknowledge your report, ask follow-up questions, or send status updates.
Scope
This program covers Eudia-operated systems, including our Gov2 production internet-facing services.
- In scope: Eudia-operated public-facing production applications, web interfaces, and APIs.
- Out of scope: third-party services and infrastructure, including systems operated by vendors, partners, or customers; non-production environments; internal-only services.
If you are unsure whether a particular hostname, endpoint, or service is in scope, contact vulnerability@eudia.com before testing. Do not assume that a shared domain or integration makes a third-party system in scope.
Responsible Disclosure
You should not take any actions that interfere or disrupt the service. If you are in doubt, and think there might be a risk of service disruption, then don't try to verify the bug yourself – email us and we'll work with you to verify it.
Email vulnerability@eudia.com with a description of the issue. If you provide contact information, we will acknowledge your report within 3 business days. This is an acknowledgement commitment, not a guaranteed remediation deadline.
Prohibited Testing Methods and Data Handling
- Do not conduct denial-of-service (DoS/DDoS), load, or stress testing, or any activity that degrades availability or disrupts services.
- Do not use social engineering, phishing, impersonation, or physical intrusion to test employees, contractors, customers, or facilities.
- Do not intentionally access, download, copy, retain, alter, delete, or disclose customer data, personal information, credentials, or other sensitive information. Use your own authorized test accounts and synthetic data.
- If you encounter sensitive information inadvertently, stop testing immediately, notify vulnerability@eudia.com, and do not access it further, copy it, retain it, or share it. Do not include sensitive data in your report; coordinate secure handling with us.
- Use the minimum testing necessary to establish that a vulnerability exists. Do not exfiltrate data, establish persistent access, pivot to other systems, or exploit the issue beyond what is necessary to demonstrate it safely.
Coordinated Disclosure and Reporter Updates
After acknowledging a report, we will triage it, assess its severity and impact, and work with the reporter to establish target remediation and public-disclosure dates. Remediation timing is set per report based on severity per internal vulnerability handling procedures.
For reporters who provide contact information, we will share the initial triage outcome, agree on an update cadence, and keep the reporter informed of investigation and remediation progress until closure. We will communicate material changes to target dates and notify the reporter when the issue is resolved or the report is closed, including the outcome.
Please give us a reasonable opportunity to investigate and remediate before publicly disclosing the issue. We will coordinate the timing and content of any public disclosure with you and revisit the agreed timeline if remediation is delayed. Do not publish customer data, credentials, or other sensitive information.
Safe Harbor
Safe Harbor supports the protection of organizations and hackers engaged in Good Faith Security Research. “Good Faith Security Research” is accessing a computer solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability, where such activity is carried out in a manner designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices, machines, or online services to which the accessed computer belongs, or those who use such devices, machines, or online services.
We consider Good Faith Security Research to be authorized activity that is protected from adversarial legal action by us. We waive any relevant restriction in our Terms of Service (“TOS”) and/or Acceptable Use Policies (“AUP”) that conflicts with the standard for Good Faith Security Research outlined here.
This means that, for activity conducted while this program is active, we:
- Will not bring legal action against you for Good Faith Security Research, including for bypassing technological measures we use to protect the applications in scope; and,
- Will take steps to make known that you conducted Good Faith Security Research if someone else brings legal action against you.
You should contact us for clarification before engaging in conduct that you think may be inconsistent with Good Faith Security Research or unaddressed by our policy.
Keep in mind that we are not able to authorize security research on third-party infrastructure, and a third party is not bound by this safe harbor statement.