Reporting a vulnerability
Send a private report to info@digitalis.io with the subject “PulsusDB security report”. Do not include sensitive vulnerability details in a public GitHub issue
Include enough information for the team to reproduce and assess the issue. Useful details include the affected version or commit, deployment context, reproduction steps, expected impact and any suggested remediation. Provide a safe way to contact you if ordinary email is not suitable
Responsible disclosure
- Allow reasonable time for investigation and remediation before public disclosure
- Avoid accessing, changing or retaining data that does not belong to you
- Avoid service disruption, denial of service, social engineering and physical testing
- Stop testing and report the issue if you encounter personal data, credentials or other sensitive information
- Describe only the minimum proof needed to demonstrate the issue
Scope
Reports may cover the PulsusDB source code, its documented APIs, build and release artefacts, and this website. Security issues in a third-party dependency should also be reported to that project when its disclosure process permits it
General defects, feature requests and documentation corrections that do not expose a security risk should be submitted through the public issue tracker
Project and deployment security
PulsusDB is under active development, so interfaces and security controls can change. Operators remain responsible for deployment-specific controls such as network boundaries, TLS, authentication, authorisation, secret management, ClickHouse database access, backups, retention and software updates
PulsusDB is developed by digitalis.io Limited, which operates an ISO 27001-certified information security management system. This is a company-level certification and is not a separate product certification for PulsusDB