Draft for legal review. This document is not yet in effect. Items in square brackets are confirmed before publication.
Draft
Security disclosure policy
We welcome reports from security researchers. If you believe you have found a vulnerability in ELOS, please tell us privately so we can fix it.
On this page
How to report
Email elos@sanshivashell.app with a description of the issue, the steps to reproduce it, and its likely impact. Please don't share the details publicly until we have fixed it.
Scope
- In scope: the ELOS product, its public API, and this website.
- Out of scope: denial-of-service testing, social engineering, physical attacks, and the third-party tools customers connect.
- Test only against workspaces you created yourself. Never access, change or keep another customer's data.
Safe harbour
If you act in good faith, stay within this policy and give us reasonable time to fix the issue, we will not take legal action against you for your research, and we will say so if a third party does.
What to expect
- We acknowledge reports within 3 business days.
- We keep you informed while we investigate and fix the issue.
- With your permission, we credit you once the fix is released.
Related: Security and trust · Acceptable use