Our Vulnerability Disclosure Policy explains how to report security findings, which assets are covered, and what you can expect during the analysis and remediation process.
≤ 3 business daysfor acknowledgment of receipt
Status update every 10 business days
Official Channels
Conduct your research responsibly and within clear boundaries.
Within the scope
- Supported Aranda Cloud and On-Premise products.
- Domains, subdomains, public APIs, and official portals.
- In-house components that affect confidentiality, integrity, or availability.
Out of reach
- DoS/DDoS, destructive or resilience testing.
- Social engineering, spam, physical attacks, or physical access.
- Third-party sites and non-public Dev/Test environments.
- Automatic scanners without validation or proven performance.
Sufficient information to validate and reproduce the finding.
Description and Reproduction
Describe the problem, the steps to reproduce it, the version, the affected URL or console, and the expected impact.
Technical evidence
Attach screenshots, logs, traffic data, a non-destructive proof-of-concept (PoC), and an analysis or ethical hacking report, as applicable.
Exhibition Context
Indicate whether the finding is multi-tenant, cross-tenant, single-tenant, or client-specific.
Five Steps to Coordinated Outreach.
Gather evidence
Validate only what is necessary, and avoid destructive testing or unnecessary access to data.
Submit the report
Email security@arandasoft.com or open a ticket in ASMS Customer.
Protect your information
Encrypt your email with PGP and mask personal information or trade secrets.
Receive confirmation
Aranda acknowledges receipt and requests additional information when necessary.
We coordinate outreach efforts
We agreed on the release window and the mitigation or correction plan.
Clear communication throughout the entire cycle.
Confirmation of Receipt
Initial confirmation upon receipt of the report.
Status Update
Regular updates until the issue is resolved or the mitigation measure is published.
Remediation
Priority depends on impact, exploitability, exposure, and business risk.
Safe Harbor for Good-Faith Research
Aranda will not take legal action against those who act in good faith, within the scope of the program and through official channels, using non-destructive testing and coordinated disclosure.
Remediation depends on the deployment model.
Cloud (Aranda SaaS)
Mitigations and fixes are deployed to the service managed by Aranda, in accordance with the maintenance windows and the latest version.
On-Premise
Workarounds may be provided for the installed version; definitive fixes are delivered in a supported and recommended version.
Straightforward Answers About Integrations
Does Aranda offer monetary rewards?
This policy does not constitute a public bug bounty program. Any future private programs will be explicitly announced.
Can I publish the finding right away?
No. Please respect a coordinated disclosure window until a mitigation is available or a publication date is agreed upon.
What should I do if I accidentally access sensitive data?
Stop the test, do not download or share the information, and report it immediately through the secure channel.
Can I receive public recognition?
Yes. With your permission, Aranda may include your name or alias in its Hall of Thanks.