Vulnerability Disclosure

Write to the address shown at the foot of this document with a description of the problem, the steps to reproduce it, the impact you estimate and any evidence that helps to verify it. If you need to encrypt the message, ask us for the public key at that same address.

A useful report does not require a working exploit: a precise description of the condition and of how to reach it is sufficient.

• Acknowledgment of receipt within three business days following the report.
• An initial assessment, with our reading of the impact, within ten business days.
• Updates on the progress of the fix until it is closed.
• Public acknowledgment of your finding if you so wish, or confidentiality of your identity if you prefer to remain anonymous.

The domains and services operated by Edelon, including this corporate site, are within scope.

Environments deployed within the infrastructure of a client institution are out of scope: they are not ours to authorize testing on. If your finding affects one of those environments, report it anyway and we will coordinate with the institution that owns it.

Edelon will not take legal action against anyone who researches and reports in good faith in compliance with these conditions: not accessing third-party data beyond the minimum needed to demonstrate the problem, not degrading or disrupting the service, not exfiltrating or retaining information obtained, and allowing a reasonable period for remediation before any publication.

This safe harbor covers what Edelon is able to commit to. It cannot be extended to third parties or override the law applicable in your jurisdiction.

Edelon does not currently operate a monetary rewards program. The absence of payment does not diminish the value of the report or the commitment to respond within the stated time frames. If a paid program is established in the future, it will be announced in this document with its date.