Despite the fact that many efforts are made to manage and secure our systems, applications, networks and products (deployed at our customer networks) with great care, it unfortunately sometimes happens that a vulnerability remains.
Vulnerabilities can be accidentally found by using our services or by actively searching for it.
Be aware, a responsible disclosure is not an invite to scan Traxion’s network or Traxion managed customer IT systems to explore these networks and discover vulnerabilities. Our network is monitored by our Services team and they are following up on these scans which might result in unnecessary investigation efforts.
In case you found a vulnerability and/or misconfiguration and/or other security risks, we ask you to report it as soon as possible. It provides us the ability with your support to remediate the vulnerability as soon as possible on Traxion’s and Traxion managed customer IT systems.
We ask that you:
- Fill in this form with your findings as quickly as possible. Encrypt your findings using our PGP key to prevent critical information from being access by unauthorized parties.
- Handle the knowledge of the security problem responsibly and do not abuse the vulnerability; for example, by downloading, editing or deleting data. We will always take your report seriously and investigate any suspicions of a vulnerability, even without proof.
- Please do not share the problem with others until it has been resolved. Under normal circumstances we should be able to do that within thirty days, and you’re free to publish after that. If we see exceptional circumstances, we’ll get in touch with you to work out a better publication deadline for both of us. Traxion reserves all rights to limit the information to be published.
- Do not make use of attacks on physical security, of social engineering or hacking tools, such as vulnerability scanners.
- Give adequate information for the problem to be reproduced so that we can resolve it as quickly as possible. Usually, the IP address or the URL of the affected system and a description of the vulnerability are enough, although more information might be necessary for more complex vulnerabilities.
- At the very least, please provide an e-mail address or telephone number to enable us to contact you if we have any questions. We prefer to communicate via e-mail.
Menu
