Responsible Disclosure

How to report a security vulnerability to Pulsor.

Draft document, awaiting legal review. It describes how Pulsor Suite actually works but has no contractual value until the reviewed version is published. Items in square brackets are still to be completed.

1. How to report

Use the contact form with the « Security » topic, or the security address shown above once it is active. Describe the issue, the affected address or component and how to reproduce it; do not include personal data you may have seen.

2. Scope

this website (pulsorsuite.com) and the platform (app.pulsorsuite.com);
the Pulsor agent for Windows, macOS and Linux, and its update mechanism;
the Pulsor APIs.

Out of scope: denial-of-service, social engineering, physical attacks, reports from automated scanners without demonstrated impact, the services of our providers.

3. Rules of engagement

test only with your own account, never with another Customer's data;
stop as soon as you reach data that is not yours, and tell us;
do not degrade the service, do not keep or share data;
give us reasonable time to fix before any publication ([90] days unless agreed otherwise).

4. Our commitments

acknowledgement within [3] business days and an initial assessment within [10];
information on the fix;
no legal action against good-faith research that follows these rules;
public thanks if you wish. There is no paid bug bounty at this date.