Vulnerability Disclosure Policy
Security at SteepDesk
SteepDesk takes the security of its platform and its customers' data seriously. This page describes how to report a vulnerability, what to expect from us in return, and our safe-harbor commitments.
Reporting a Vulnerability
Please do not open a public GitHub issue for security reports.
Report suspected vulnerabilities to:
- Email: security@steepdesk.com
- Machine-readable disclosure policy: /.well-known/security.txt
Please include:
- A clear description of the issue
- Steps to reproduce (proof-of-concept code or HTTP requests where applicable)
- Affected component(s) and version(s)
- Any known impact (data exposure, privilege escalation, etc.)
- Your name or handle if you would like to be credited
What to Expect
| Stage | Target |
|---|---|
| Acknowledgement of receipt | Within 2 business days |
| Initial triage and severity assessment | Within 5 business days |
| Status updates during investigation | At least weekly |
| Resolution or mitigation for Critical / High findings | Within 30 days where feasible |
We follow coordinated disclosure: we ask that you give us a reasonable window to remediate before any public disclosure. We will credit reporters who request it once a fix has shipped.
Safe Harbor
We will not pursue legal action against researchers who:
- Make a good-faith effort to avoid privacy violations, service disruption, and data destruction
- Only access data necessary to demonstrate the vulnerability
- Do not exfiltrate, modify, or destroy customer data
- Give us a reasonable opportunity to remediate before public disclosure
- Do not violate any other applicable law
Supported Versions
SteepDesk is a continuously deployed SaaS product. The hosted production version at steepdesk.com is the only supported version and always receives security updates immediately.
| Version | Supported |
|---|---|
| Hosted production (latest) | Yes |
| Tagged releases (v0.x.y) | No — reference points only; self-hosting is not supported |
| main branch | Pre-release; not for production use |