Vulnerability Disclosure Policy
Publisher: Quicksand Cyber Defense Zrt. (company reg. no. 01-10-143708), Hungary. Contact: support@quicksand.hu. Machine-readable contact file (RFC 9116): https://quicksand.hu/.well-known/security.txt.
1. Our promise
If you find a security issue in Quicksand, our websites, our infrastructure or any software we publish, we want to hear from you. Reports made in good faith under this policy will not lead to legal action against you; we will work with you to fix the issue and credit you (with your permission).
2. Scope
In scope:
- The Quicksand product: any quicksand-* container image or virtual appliance we publish.
- Web surfaces under *.quicksand.hu and qcdcloud.eu operated by us.
- Source code we publish that reaches a customer deployment.
Out of scope:
- Websites of our customers that are merely protected by Quicksand: please report to the site owner (via the site's own security.txt, if it has one).
- Third-party services we use: please report directly to that vendor.
- Social engineering of our staff.
- Physical attacks on our offices or hosting facilities.
- Denial-of-service or volumetric testing against production.
- Findings that require physical access to a customer's hardware.
- Best-practice recommendations without a working exploit.
3. Safe harbour
We will not pursue civil action or file a complaint with law enforcement for security research conducted under this policy that:
- stays within the scope above;
- avoids privacy violations, destruction of data and disruption of service;
- stops as soon as you have enough evidence to write the report;
- gives us reasonable time to fix the issue before any public disclosure (see below).
If you are unsure whether an activity is in scope, contact us first.
4. How to report
E-mail support@quicksand.hu. Encrypted e-mail is not offered yet; if your report contains sensitive exploit details, send a short first message and we will agree on a secure channel. Please include:
- a description of the issue and the affected component or URL;
- reproduction steps or a proof of concept;
- the impact you have assessed (data exposure, code execution, privilege escalation, …);
- whether you have shared it with anyone else;
- how you would like to be credited, or whether you prefer to remain anonymous.
5. What happens next
| Time | Action |
|---|---|
| within 2 working days | We acknowledge receipt of your report. |
| within 5 working days | We confirm whether the issue is reproducible and in scope. |
| within 30 days (typical) | We deliver a fix, credit you in the release notes (with your permission) and agree the disclosure timing with you. |
| 90 days (default) | Coordinated disclosure, or sooner if a fix has shipped and we both agree. If customer coordination is needed, we agree an extended timeline with you. |
We will not disclose your identity without your written permission.
6. No bug bounty
We do not run a paid bug bounty programme: no payments are made unless explicitly offered in writing. Output of automated scanners without a specific, reproducible issue is not credited.