Trust
Responsible disclosure
If you have found a security issue in a Sailient system, we want to hear about it, and we will not treat a good-faith report as an attack.
How to report
Email security@sailientgroup.com. Please use email rather than the public contact form so the report is not handled as a commercial enquiry.
What to include
- The affected system, URL or component
- A description of the issue and why it matters
- Steps to reproduce, in enough detail for us to confirm it
- Any logs, requests or screenshots that help
- How you would like to be credited, if at all
How we handle it
- We acknowledge receipt and tell you who is handling it
- We confirm or reject the finding and explain the reasoning
- We agree a remediation timeline with you where the issue is confirmed
- We tell you when it is fixed
We do not currently operate a paid bug bounty. That is a statement of fact, not a reflection of how seriously a report is taken.
Please do not
- Access, modify or delete data that is not yours
- Degrade service for other users, including load or denial-of-service testing
- Use social engineering or physical intrusion against staff or premises
- Publish the issue before we have had a reasonable chance to fix it
Scope
Sailient systems and this website. Third-party services Sailient uses should be reported to their own security teams; tell us as well if the issue affects Sailient data.