Reporting a security problem
If you have found a vulnerability in something of ours, we want to hear about it, and we would rather hear it from you than from an incident.
How to reach us
Mail support@novogara.com with “security” in the subject. It reaches an engineer at any hour. Include:
- What you found, and where — an address, a hostname, a URL
- How to reproduce it, step by step
- What an attacker could do with it
- How we can reach you for follow-up
Encrypt it if the detail is sensitive; ask and we will give you a key.
What we ask
- Give us time to fix it before publishing. We will agree a timeline with you and keep to it.
- Do not access other people's data. Proving a vulnerability exists does not require reading someone's database. Stop at the point where it is demonstrated.
- Do not degrade service. No denial of service testing, no brute forcing, no automated scanning at a rate that affects other customers.
- Do not alter or delete anything.
Research that respects those lines is welcome, and we will not pursue someone who reports a genuine problem in good faith.
What is in scope
Our own infrastructure: the website, the customer portal, our API, our mail and DNS, our network equipment.
What is not
Our customers' servers. The machines on our network are unmanaged and the software on them belongs to the customer. Testing a customer's server without their permission is unauthorised access regardless of your intentions, and we cannot give you that permission on their behalf.
If you have found something on a customer's machine — an exposed database, a compromised host sending spam, an open resolver — report it to us as an abuse matter and we will pass it to them. That is a genuinely useful thing to do, and it is how a great many compromises get found. See what to do with an abuse notice.
Also out of scope: findings from an automated scanner with no demonstrated impact, missing headers that cannot be exploited, and the usual list of theoretical issues on a static site.
What we do
- Acknowledge, usually within hours
- Verify and assess the impact
- Fix it, with a timeline we tell you
- Tell you when it is done, and credit you if you want it
We do not run a paid bounty programme. We do read every report, we answer, and we say what we did.
If it is your own server
Then it is yours to fix, and a compromised server and securing a new server are the places to start. Tell us anyway if traffic has left the machine — we would rather hear it from you first.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base