Vulnerability disclosure policy

Version 2026-10-12

We want to hear about security problems in SnagBane. If you think you found one, please tell us privately first, so we can fix it before it is public.

How to report

Email support@snagbane.com with “Security” in the subject. Please include:

  • the SnagBane version and edition (Settings → System & updates shows both), and how it is installed (Docker, VPS, cPanel);
  • what an attacker can do, and the steps or a short proof of concept to reproduce it;
  • whether it needs an account, and which role;
  • how you would like to be credited, if at all.

Please don’t open a public issue or post details before a fix is available. Machine-readable contact details are in /.well-known/security.txt.

What we commit to

  • We reply within 5 business days to confirm we received your report.
  • We keep you informed at least every 14 days until the problem is resolved.
  • We aim to release a fix for confirmed critical problems within 7 days and for high-severity problems within 30 days, sooner when they are being exploited.
  • We name the fix in the release notes of the update and credit you there if you want.
  • We agree with you when details are published — after the fix is out, or 90 days after your report if we haven’t fixed it by then, unless we agree otherwise.

We don’t run a paid bug bounty.

Scope

In scope: the SnagBane software (free and paid packages, latest version), the snagbane.com website, and SnagBane’s update and licence services.

Out of scope: other organisations’ SnagBane installations — report those to the organisation that runs them; problems that need a compromised server or administrator account; missing hardening that the administrator controls (for example a disabled setting); denial of service and volume testing; social engineering; and third-party services such as Microsoft 365, Google, Freemius or Cloudflare.

Testing in good faith

Test on your own installation — SnagBane’s server code ships in readable form so you can review and security-test it (licence agreement, section 2.3). On our website and services, use only your own accounts and normal request rates; don’t access, change or keep other people’s data, and stop and report as soon as you see any. We won’t take legal action against research done in good faith under this policy.

After an update

Security fixes ship as normal updates. Administrators install them from Settings → System & updates → Updates; every package is signed and checked before it is installed.