1.How to report
Write to security@malnox.com. We acknowledge within 3 business days and tell you the same day whether the report is in scope.
Include reproduction steps, product version, Windows version and the impact you estimate. If you have a proof of concept, attach it — we do not execute it on production systems.
- security@malnox.com
- Do not send other users' personal data and do not test on systems you do not own.
2.What is in scope
Product components that process data: the scanning engine, the YARA rule parser, the archive engine, the local service on 127.0.0.1:4711, the quarantine API, authentication and RBAC, intel package import, the service host and the installer.
- In scope: code execution, privilege escalation, path traversal, quarantine bypass, authentication bypass, integrity corruption of signed packages.
- Out of scope: the absence of a signed driver and other features explicitly declared as limitations in the README, attacks requiring local administrator already, social engineering, DoS by deliberately exhausting local resources.
3.The process, with timelines
We acknowledge within 3 business days, give an initial assessment within 10 business days and work on a fix. We update you every 14 days, even when there is no news — an ignored report is worse than a clear rejection.
We keep the issue confidential until a fix ships, then publish an advisory with the technical description. We do not publish the researcher's name without explicit consent.
4.Recognition
We do not have a fixed financial bounty for reports, but we offer public credit, a free year of Malnox Complete and, if you want, a written reference for your portfolio.
We will not pursue anyone who reports in good faith and follows this policy. If you are unsure about a test, ask us first.
A question about this document? Write to privacy@malnox.com or use the contact form.