Tell us at security@svnkg.com
Write to security@svnkg.com. A short description and the steps to reproduce the problem are enough to start; you do not need a formal write-up, and you should not wait until you have one.
If you can, include what you were trying to do, what happened instead, and roughly when. If a proof of concept exists and you are comfortable sharing it, that saves us time. If it does not, send the report anyway.
What we commit to
- A reply
- We acknowledge every report within three business days. SEVEN KG is one person, so that is a promise we can keep rather than an aspiration.
- Honesty about the outcome
- We will tell you whether we consider it a vulnerability, and if we disagree we will explain why rather than going quiet.
- Credit, if you want it
- We are glad to name you when the issue is fixed. We are equally glad not to.
- No legal action
- We will not pursue anyone who reports a genuine vulnerability in good faith and gives us a reasonable opportunity to fix it before disclosing it publicly. That commitment appears in our Privacy Policy as well, so it is not something we can quietly withdraw.
What is in scope
The public website at svnkg.com, the coordinator API at api.svnkg.com, and the SEVEN KG Attest application for Android.
We are particularly interested in anything that would let a device present attestation evidence that does not reflect its real state, or that would let one participant reach another participant's job, results or evidence. Those are the failures that would matter most, because the whole service rests on them being impossible.
What is out of scope
- Our development and laboratory environment, which runs on a private network and deliberately serves plain HTTP. It holds no customer data and the server says so at startup.
- Issues in the services we depend on rather than operate. Our sub-processors are listed publicly, and a problem in one of them should go to them directly.
- Social engineering, physical access, and anything aimed at a person rather than a system.
- Denial of service and volumetric testing. Please do not.
- Reports produced solely by an automated scanner with no evidence of real impact.
What we ask of you
Do not access, modify or retain data that is not yours. If you come across someone else's information while testing, stop and tell us — that alone is a valuable report.
Do not degrade the service for anyone else. Give us a reasonable opportunity to fix the problem before you write about it publicly. What counts as reasonable depends on the issue, and we would rather agree it with you than impose a number.
What we cannot offer
There is no bug bounty and no payment. SEVEN KG is one person and is pre-revenue, and we would rather say that plainly than advertise a reward we cannot fund. If that changes, this page changes with it.
We also hold no third-party security certification of any kind. What we do instead is document our actual technical measures and let people check them.
For machines
Our disclosure contact is also published in machine-readable form at /.well-known/security.txt, following RFC 9116. It is plain text because scanners and command-line tools are its intended audience.
It is not yet signed with a disclosure PGP key. When one exists, a Signature field will appear there and this line will say so.