Vulnerability Disclosure Policy

Send reports to support@greyarm.com. Please include the affected product and version or URL, a description of the issue and its impact, steps to reproduce, and any proof-of-concept. Tell us how you would like to be credited, if at all.

We aim to acknowledge your report within 3 business days and give you an initial assessment within 10 business days, and we will keep you informed until it is resolved.

In scope: greyarm.com and its subdomains operated by GreyArm, LLC, the web console, our APIs, the GreyArm desktop sensor and the GreyArm mobile apps.

Out of scope: third-party services we use (report those to their owners), denial-of-service testing, social engineering or phishing of our staff or users, physical attacks, spam, and findings that require a compromised device or unlikely user interaction.

• Use only accounts you own or have permission to use, and never access, modify or delete other people’s data. If you encounter it, stop and tell us.
• Do not degrade the Services, run automated scans at volume, or test on anyone else’s devices.
• Give us a reasonable time to fix the issue before disclosing it publicly — we aim for 90 days and will coordinate a disclosure date with you.

If you make a good-faith effort to follow this policy, we consider your research authorized, will not pursue or support legal action against you for it, and will make clear to others that you acted under this policy. If you are unsure whether something is allowed, ask us first. GreyArm, LLC does not currently run a paid bug-bounty program.