Vulnerability disclosure
Segmenta runs on production servers and writes their firewall rules, so a flaw in it matters. If you find one, this page says how to reach us, what we will do, and what research we authorise.
Reporting
Email [email protected] with what you found, where, the steps to reproduce it and what an attacker could do with it. A proof of concept helps; a working exploit against someone else's data is not needed and not wanted.
A person replies to say we have it, and asks anything we need to reproduce it.
Our assessment: whether we can reproduce it, how severe we think it is, and when we expect to fix it.
We aim to fix critical issues within 7 days, high within 30 and the rest within 90, and we tell you when the fix ships.
With your permission we name you below once the fix is out. We don't run a paid bug bounty yet.
Safe harbour
If you act in good faith and within the rules below, we consider your research authorised, we won't take or support legal action against you for it, and if anyone else does, we will say that you had our permission.
Start a trial and test against it. Never against another customer's organization, hosts or data.
If you reach data that isn't yours, stop, don't keep or share it, and tell us straight away.
No denial of service, load testing or spam, and nothing that changes another customer's firewall rules.
Keep it confidential until it's fixed, or for 90 days from your report, whichever comes first. We'll agree a date with you.
Scope
This website and the Segmenta console (segmenta.com.au, app.segmenta.com.au and the console's older name, segmenta.softmail.co.za), the agent listener and update channel, the Segmenta agent for Windows and Linux, the Segmenta Workstation package for Windows and macOS, the Kubernetes connector, and the installers we publish.
Denial of service, social engineering or phishing of our people, physical attacks, and reports from automated scanners without a demonstrated impact. Missing headers or email records are welcome as a note, but aren't vulnerabilities on their own.
Segmenta runs on Google Cloud and Cloudflare, and sends email through a delivery service. A flaw in one of them belongs to that company's own disclosure programme. Tell us too if it affects Segmenta.
Our contact details are also published at /.well-known/security.txt (RFC 9116).
Thanks
Nobody yet. Be the first.