Reporting a security problem
If you've found a security problem in Minaki Scan or this website, we want to hear about it. Here's how to tell us, and what we'll do.
How to reach us
Email support@minakilabs.com and start the subject line with "Security", so we can pick it out quickly.
Our contact details are also published in the standard machine-readable form at /.well-known/security.txt.
What to report
- Minaki Scan itself. For example, a way to make the scanner change something without your approval, run code it shouldn't, miss or hide a finding, or harm the server it's checking.
- This website, minaki.io.
- Our packages and signing. For example, a way to get an unsigned or altered package or update accepted as ours.
What to include
- What you found, and what an attacker could do with it.
- Steps we can follow to see it ourselves.
- The Minaki Scan version (
minaki-scan --version) and Linux distribution, if it's about the scanner. - How you'd like to be credited, if at all.
Please don't send real malware or anyone else's personal data. A description is enough.
What we promise
- We'll confirm we got your report within 3 business days.
- We'll keep you updated while we work on it, and tell you when it's fixed.
- We'll credit you when we describe the fix, if you'd like us to.
- We won't take legal action against you for security research done in good faith and within the scope on this page.
Good faith means you try not to harm anyone, you don't access or keep more data than you need to show the problem, and you give us a reasonable chance to fix it before you tell anyone else.
Out of scope
- Anything not listed under what to report.
- Systems that aren't ours, including other companies' services we use.
- Denial of service: anything that floods or overloads a system.
- Spam, and social engineering of anyone, such as phishing.
- Physical attacks.
Rewards
We don't run a bug bounty program today, so we can't pay for reports. We're grateful for them all the same.