Vulnerability Disclosure Policy

How to report

Write to security@reterea.com in English or Italian. If you need an encrypted channel, ask in your first message and we will arrange one. Please include:

• the affected component (web application, API, endpoint agent sgagent) and version, if known;
• the steps to reproduce it, with a proof of concept where possible;
• the impact you expect, and how you would like to be credited, if at all.

In scope

• The Sherlock Guard web application and API at sherlockguard.com.
• The endpoint agent sgagent and its installer and update channel.
• Public pages served by the platform, such as the trust portals at /trust/….

Out of scope

• Denial of service, load or stress testing, and high-volume automated scanning.
• Social engineering, phishing, and physical attacks against our staff or premises.
• Services of our providers (for example payment, hosting or code hosting): report those to the provider.
• Systems and products of our customers: report those to the customer, for example through their trust portal.
• Findings without a demonstrated security impact, such as a missing header or version banner on its own.

Rules for testing

• Test only with accounts you own: a free trial account is enough.
• Do not access, modify or delete data that is not yours. If you reach other users' data by accident, stop, do not keep a copy, and tell us.
• Go only as far as needed to prove the issue.
• Keep the details confidential until we have released a fix, or until the deadline below.

What we commit to

• Acknowledge your report within 3 working days.
• Give you a first assessment within 10 working days, and keep you updated until the issue is closed.
• Fix confirmed issues by severity: critical within 7 days, high within 30, medium within 90.
• Agree a public disclosure date with you, by default 90 days after the report, and credit you if you wish.
• Not take legal action against research carried out in good faith and within these rules.

Cyber Resilience Act

• Actively exploited vulnerabilities in our products are notified as required by Regulation (EU) 2024/2847, art. 14.
• Vulnerabilities found in third-party components we use are reported to whoever maintains them.