Vulnerability disclosure
Found something? Tell us first.
Reports go only to kymeer product security, never to partner or support queues.
In scope
- kymeer SaaS (app.kymeer.com) and regional clusters
- kymeer on-prem releases
- The partner portal
- This website
Out of scope
- Denial-of-service and volumetric testing
- Social engineering of staff or partners
- Physical attacks
- Testing against customer tenants or data you do not own
Please
- Give us reasonable time to fix before disclosure.
- Do not access, modify or keep data that is not yours.
- Stop and report as soon as you reach sensitive data.
Safe harbour
If you make a good-faith effort to follow this policy, we consider your research authorised, will not take or support legal action against you for it, and will work with you to understand and fix the issue. If someone else takes action against you over research that followed this policy, we will make it known that it was authorised. This policy does not authorise testing of systems kymeer does not own, including partner and customer environments, and it does not cover demands for payment in return for not disclosing an issue.
What happens next
Product security acknowledges, triages and keeps you updated. Fixed issues are published as advisories.