At Promon, we are committed to maintaining the highest standards of security for our products and for the applications protected by them. We value responsible security research and appreciate the efforts of those who help us identify potential vulnerabilities. We aim to work collaboratively, transparently, and efficiently to assess and address reported issues.

Reporting a Security Issue
If you believe you have identified a security vulnerability related to Promon products or a Promon-protected application, please report it to:
security@promon.io

To enable effective assessment, reports must include sufficient detail for us to understand, reproduce, and validate the issue.

Required information
Please include:

· A clear description of the issue and affected component(s)

· Step-by-step instructions to reproduce the finding

· Supporting evidence (e.g. logs, screenshots, proof-of-concept code)

· Details of the test environment and configuration

· An assessment of the potential impact

Reports that do not provide enough detail to enable reproduction and validation cannot be assessed and will not be progressed.

Scope and Assessment
Promon provides security protections for applications. Our assessment focuses on the effectiveness of these protections under realistic deployment conditions and configurations.

Where findings are influenced by:

· application implementation,

· configuration choices, or

· external dependencies,

· we will work with the reporting party and relevant stakeholders to determine the appropriate context and impact.

Coordinated Disclosure
We follow a coordinated vulnerability disclosure approach:

· Vulnerabilities must be reported to Promon privately and in full before any public disclosure

· We will investigate and respond in a timely manner

· We will work with stakeholders to agree on an appropriate disclosure timeline

We ask that reporters do not disclose vulnerabilities publicly until:

· the issue has been validated and addressed, or

· a coordinated disclosure timeline has been agreed

Good Faith Research
We support security research conducted in good faith. We ask that you:

· Act responsibly and avoid harm to users, data, or services

· Do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the issue

· Do not exploit vulnerabilities beyond proof-of-concept

· Do not make demands for payment or other conditions tied to disclosure

Our Commitment
When you report a vulnerability to Promon, we will:

· Acknowledge receipt of your report

· Assess and validate the findings objectively

· Communicate clearly throughout the process

· Provide transparency on impact and remediation

Contact
For all security-related inquiries, please contact:
security@promon.io