Security & Disclosure
Security is what we build, so we take reports about our own security seriously. If you believe you have found a vulnerability in SENTRA or this website, we want to hear from you and will work with you to fix it.
How to report
Email security@sentra-ai.com with:
- the product, URL or component affected;
- a description of the issue and its potential impact;
- clear steps to reproduce it, with any proof-of-concept;
- how you would like to be credited, if at all.
Our contact details are also published in machine-readable form at /.well-known/security.txt.
What to expect from us
- We will acknowledge your report and keep you informed as we investigate.
- We will work to confirm and fix valid issues as quickly as their severity requires.
- We will let you know when the issue is resolved, and credit you if you wish once a fix is available.
Guidelines for researchers
When investigating, please:
- test only against your own accounts, or systems you are authorised to test;
- not access, change or delete data that is not yours; stop and report as soon as you encounter someone else's data;
- not degrade the service for others: no denial-of-service testing, spam or social engineering of our staff or customers;
- not test infrastructure belonging to our customers or their end users;
- give us reasonable time to fix the issue before you disclose it publicly, and coordinate disclosure with us.
Safe harbour
If you make a good-faith effort to follow this policy, we will consider your research authorised, will not pursue legal action against you for it, and will not ask law enforcement to do so. If a third party takes legal action over research you carried out under this policy, we will make it known that you acted in line with it. This does not authorise access to third-party systems, which requires their own permission.
Out of scope
- Reports from automated scanners without a demonstrated security impact.
- Missing security headers or best-practice suggestions with no exploitable impact.
- Issues that require physical access to a device, or a compromised user account or device.
- Social engineering, phishing and physical attacks.
Rewards
We do not currently run a paid bug bounty programme. We are grateful for responsible reports and are happy to credit researchers publicly.