Security and vulnerability disclosure

How to report a suspected vulnerability safely.

Report a vulnerability

Email vulnerability reports to security@sarpedonqualitylab.us. This security policy is available at https://sarpedonqualitylab.us/security.

Include the affected product and version, a clear description, steps to reproduce the issue, and the potential impact. Do not include credentials, customer data, SQL Server evidence, findings, reports, database names, or login names.

For subscription, installation, activation, entitlement, or general product help, use https://sarpedonqualitylab.us/support or email support@sarpedonqualitylab.us. Vulnerability reports and product-support requests follow separate routes and response processes.

What to expect

We will acknowledge a security report within two business days and provide an initial scope and severity assessment within ten business days.

These are acknowledgement and initial-assessment targets, not commitments to resolve or fix an issue within those periods. Business days are Monday through Friday, excluding public holidays. We do not promise response hours, a time-zone-specific response window, an availability service level, a bug bounty, or payment.

Safe harbor for good-faith research

We support good-faith security research conducted within this policy. Limit testing to what is necessary to confirm a suspected vulnerability; avoid privacy violations, service disruption, data destruction, and access to data that is not your own; stop if you encounter personal or customer data; and report the issue promptly through the dedicated security channel.

When research follows these conditions, we will treat it as authorized under this policy and will not initiate legal action based solely on that research. This policy does not create a bug bounty or payment commitment.