Reporting a vulnerability

Report a suspected vulnerability in kymeer through the form on the security page. Reports go only to kymeer product security, never to partner or support queues.

What is in scope?

In scope	Out of scope
The kymeer SaaS service (app.kymeer.com)	Denial-of-service and volumetric testing
kymeer on-prem releases	Social engineering of staff or partners
The partner portal	Physical attacks
The kymeer.com website	Testing against customer tenants or data you do not own

What should a report include?

The form asks for:

• a short summary
• the affected area: SaaS, on-prem product, partner portal, website or other
• your estimate of severity
• details and steps to reproduce
• an email address for follow-up (optional)
• a name or handle for credit (optional)

Include the version and deployment type where you know them, and the impact as you understand it. Do not include customer data or credentials.

What happens after I submit?

• You receive a reference number straight away.
• The report is stored encrypted. The alert sent to product security carries only the reference, area and severity, not the report itself.
• Product security acknowledges the report, triages it and keeps you updated. Without an email address it cannot reply to you.

What do you ask of researchers?

• Give us reasonable time to fix the issue before you disclose it.
• Do not access, modify or keep data that is not yours.
• Stop and report as soon as you reach sensitive data.

Where are fixes published?

Fixed issues are published as security advisories once a fix is available, with affected and fixed versions. The advisories page also has an RSS feed.

Is there a formal disclosure policy?

Yes. The disclosure policy sets out what is in scope, what we ask of researchers and a safe harbour for good-faith research.