Reporting a vulnerability
If you found a security problem in WardPane or on wardpane.com, tell us privately first. We will work with you on a fix and credit you if you want.
How to report
- Email [email protected]. Write in English or Russian.
- Describe the problem, the affected version and the steps to reproduce it. A proof of concept helps.
- Do not include personal data of other people, and do not test against servers you do not own.
What happens next
- We confirm that we received the report within 3 working days.
- We assess it, keep you informed and agree on a disclosure date with you.
- We ship a fix in a new release and describe it in the changelog, with credit if you want it.
In scope
- The WardPane panel and its installer, root helpers and site sandboxes
- The protection features: anything that lets a request bypass a check it should not
- The install script and its checksum check
- wardpane.com and the download service
Out of scope
- Volumetric DDoS attacks against any server
- Reports from automated scanners without a demonstrated impact
- Problems in sites hosted with WardPane that are not caused by WardPane
We will not take legal action against anyone who reports in good faith, follows this page and gives us reasonable time to fix the problem.