Security

If you have found a vulnerability in MailtronX or in this website, thank you for telling us first. This page says how, and what you can expect. It is also published in machine-readable form at /.well-known/security.txt.

Scope

The MailtronX appliance software: the console, the agent, the installer and the runtime scripts in a release package.
This website, mailtronx.com, including the release feed and the installer it serves.
The MailtronX RBL service, once it is live.

Out of scope: denial-of-service and volumetric testing; spam, phishing or social engineering against people; third-party services an appliance talks to (public DNS resolvers, blocklist operators, deliverability testers); the Debian packages the installer installs (report those upstream, and tell us too); and appliances you do not own or have no permission to test.

How to report

Write to [pending: security mailbox]. Include the release version (shown under the logo in the console), the steps to reproduce, the impact as you see it, and how we can reach you. If you prefer to encrypt, say so in a first message and we will arrange a key.

What to expect

An acknowledgement within 3 business days, and a first assessment after that.
Progress updates while we work on a fix; a fix ships as a new release through the signed update feed, and the release note names the fix.
Credit by name on this page if you want it, or anonymity if you prefer.
No monetary rewards: there is no bounty programme.

Coordinated disclosure

We ask you to keep the details confidential for up to 90 days from your report, or until a fix is released, whichever comes first. If we need longer we will say so and explain why. After that you are free to publish.

Safe harbour

Research carried out in good faith under this policy is authorised. We will not pursue legal action against you for it and will not report it to law enforcement, provided you: stay within the scope above; do not access, change or delete data that is not yours, and stop and report as soon as you encounter personal data; do not degrade the service; do not use social engineering; and give us the time described above before publishing. If a third party starts legal action against you for research that complied with this policy, we will make it known that your actions were authorised.

Supported versions

Security fixes ship as new releases; the current release is the supported one. Keep your appliances on the current release with the Patches page, where the automatic daily check can be switched on.