Security Policy
SYS3RA protects other people's computers, networks and children, so we want to hear about weaknesses in it, and we promise to treat the people who report them fairly. This page says how to report one, what you can expect from us, and what we ask of you.
Report a vulnerability
Email contact@sysera.ca with "Security report" in the subject.
Please include:
- what you found and which part of SYS3RA it affects (the console or Portal at app.sysera.ca, the API, the endpoint agent or its installers, the mobile app, or the website);
- the steps to reproduce it, or a proof of concept, and the version or the date you tested;
- what you think an attacker could do with it;
- how to reach you, and whether you want to be credited.
Please do not open a public issue, post it on social media, or tell others before we have fixed it. We have no public bug tracker, so email is the only channel.
Encrypted email. We have not published an encryption key yet. If you need an encrypted channel, send a first message that contains no details and ask for one. We will set one up with you.
What to expect from us
| Step | Target |
|---|---|
| We acknowledge your report | Within 3 business days |
| We give you our first assessment (valid, severity, who looks at it) | Within 10 business days |
| We keep you updated | At least every 14 days until it is closed |
| We fix a critical or high-severity issue | Within 30 days of confirming it |
| We fix a medium or low-severity issue | In a following release |
These are targets, not guarantees, and a complex issue can take longer; we will tell you why. We will tell you when it is fixed, and we will credit you in the advisory if you want, using the name you give.
Disclosure
We ask you to keep the details private until a fix is available, or for 90 days after we acknowledged your report, whichever comes first, unless we agree another date with you. If we fix it sooner we will tell you, and you may publish after that. When a vulnerability affects customers, we publish an advisory on sysera.ca/security after the fix is available, and we tell affected customers directly. We are happy to coordinate a date.
Safe harbour
If you act in good faith and follow this policy, we will treat your research as authorized, will not take or support legal action against you for it, and will work with you to understand and fix the problem. This policy does not bind anyone else: a customer, a service provider or a government may see it differently, and it does not allow you to test anyone's systems but ours. If a third party takes action against you for research that followed this policy, we will say so to them.
Rules for testing
- Test against your own accounts. Create two accounts of your own if you want to test the separation between customers. Do not read, change or delete anyone else's data. If you reach someone else's data by accident, stop, do not copy it, and tell us what you saw.
- Never use a real child's account or device. Do not test SYS3RA4kids against anyone's actual child. A household account you create yourself with a dummy child is fine.
- Do not disrupt the service. No denial of service, no load testing, and keep automated testing below 10 requests a second.
- No social engineering of our staff, our customers or their users, and no physical attacks.
- Do not use a vulnerability to persist, pivot or collect more than you need to show it exists.
What is in scope
- The hosted service: the console and Portal, the API, and the endpoint agent connection (app.sysera.ca and its subdomains).
- The endpoint agent and installers that we release, and the update mechanism.
- The SYS3RA4kids mobile app.
- The website at sysera.ca.
Out of scope: a customer's own self-hosted installation or its configuration; services run by others (Google, Apple, Stripe, OpenStreetMap, Slack, Microsoft and the like) even when we connect to them; reports from automated scanners with no demonstrated impact; missing headers or cookie flags with no demonstrated impact; the absence of rate limiting on a route that does no harm; self-inflicted problems that need access to the victim's own device or session; software versions older than the previous release; spam or phishing aimed at our domain without a technical flaw on our side; and denial of service.
Rewards
We do not run a bounty and cannot pay for reports. We do thank people publicly, if they want it, in the advisory.
Supported versions
The hosted service is always the current version. For software you run yourself, we fix security issues in the latest release, and tell you how to move to it.
Contacting us otherwise
Our machine-readable contact details are at sysera.ca/.well-known/security.txt. For privacy matters write to privacy@sysera.ca instead.