Vulnerability disclosure

Found a security problem? Tell us.

How to report a security vulnerability in SectraTEK, what you may test, what we promise in return, and the safe harbor we offer researchers.

Our approach

We want to hear from you.

Version 1.0. Last updated October 21, 2026.

Security researchers make SectraTEK safer. This policy tells you what you may test, how to report what you find, and what you can expect from us. If you follow it in good faith, we treat your research as authorized, as described under “Safe harbor” below.

We accept reports from anyone, anywhere, and from anonymous reporters. You do not need to be a customer.

Report a vulnerability

Write to security@sectratek.com. If you want to send details in encrypted form, write first and ask; we will arrange an encrypted channel before you send anything sensitive. Please do not use a support ticket for a vulnerability.

Scope

What you may test.

In scope

  • The website, www.sectratek.com
  • The customer area, my.sectratek.com, and its sign-in pages on auth.sectratek.com
  • The service interfaces on api.sectratek.com and dl.sectratek.com
  • The SectraTEK installers and the behavior of the installed desktop applications, on a computer you control
  • The staff console, only with test accounts that we provide to you by arrangement

Out of scope

  • Social engineering of our staff or customers, including phishing, phone pretexting and impersonation
  • Physical attacks on offices, equipment or devices that are not yours
  • Denial-of-service testing and any test that exhausts resources
  • Services run by other companies, including the providers we use to host and run the service. Report a problem in a third-party service to that company
  • Other customers’ accounts and data
  • Reports that are only scanner output, or a missing best-practice setting, with no demonstrated impact

If you do not hold a license for the desktop software and want to research it, write to us and we will talk about access. If you need a test account for the customer area or the staff console, ask first; we will tell you what is possible.

Rules of testing

Keep it careful and small.

  1. Test only with accounts and data that you own or that we have given you. Do not use anyone else’s account.
  2. Use the least access needed to show the problem. Do not copy, change, delete or keep data that is not yours.
  3. If you reach customer data, case data or personal data, stop at once. Do not save it, do not share it, and delete any copy. Report what you saw without including the data itself.
  4. Do not disrupt the service, and do not use automated tools in a way that burdens it.
  5. Do not send us evidence, case data or other people’s personal data in a report.
  6. Do not demand payment, and do not threaten to disclose a problem.
  7. Keep the details private until the disclosure window below has ended, or until we agree otherwise.
Safe harbor

Research in good faith is authorized.

We do not pursue good-faith security researchers.

This is what that means in practice. If you make a good-faith effort to follow this policy, then:

  • We treat your research as authorized. We will not bring, or support, any legal claim against you for it, including claims under computer-misuse and unauthorized-access laws, such as the Computer Fraud and Abuse Act and its state and foreign counterparts.
  • We will not rely on laws that restrict getting around technical protections, such as section 1201 of the Digital Millennium Copyright Act, for work that was needed to find and show the problem. That includes analysis of our installers and of your own copy of a SectraTEK application, on your own computer.
  • We will not treat the research as a breach of our Terms of Use, Acceptable Use Policy or license agreement.
  • We will speak up for you. If someone else starts legal action against you over research that followed this policy, we will tell them it was authorized, and we will confirm that in writing if you ask.

Good faith means that you tried to avoid harm to people and to the service, stopped when you reached data that is not yours, reported promptly, and used what you found only to report it.

Limits

We can speak only for SectraTEK and for Prudential Associates. We cannot promise what other companies, customers or public authorities will do, though we will tell them that your research was authorized. This policy does not allow you to do anything unlawful toward other people, and it does not cover conduct outside it, such as extortion, selling or publishing customer data, or attacks on staff. If you are unsure whether something is covered, ask us before you test.

How to report

What to include.

A useful report has

  • where the problem is: the address, the application and its version;
  • what it allows an attacker to do;
  • the steps to reproduce it, with proof of concept code or screenshots if you have them;
  • the time and date of your tests;
  • how you would like to be credited, or that you prefer not to be.

Where to send it

Email security@sectratek.com. The same details are in our security.txt file. Reporting a suspicious message that uses our name? Send it to the same address. What we never ask, and our official addresses, are on the Trust page.

Contact details are optional. Without them we cannot ask you questions or thank you, but we will still read the report.

What to expect

What we do with your report.

We acknowledge vulnerability reports promptly.

  • We look at the report and tell you our first assessment as soon as we can.
  • We keep you informed of progress until the problem is closed.
  • We work to fix confirmed problems and to make details public, in coordination with you.
  • We credit you publicly unless you ask us not to. We share your name or contact details only with your consent, or where the law requires.

These are goals, not promises of a fixed result. A complex problem can take longer, and if it does we will tell you why. If a problem is being actively exploited we may act sooner, and we will tell you before we do.

Disclosure

Please wait for our fix and advisory, or until 90 days after your report if that comes first, before you publish. If you think the risk to people is urgent, or you need more time, tell us and we will agree a date with you. When a confirmed problem affects customers, we publish a numbered notice on the security advisories page.

Rewards

We do not currently offer monetary rewards. By reporting, you agree not to ask for payment. We are grateful for every report, and we will say so.

The fine print

This policy is not a contract, and it does not authorize anything unlawful toward other people. We may change it; the version and date are at the top of this page, and earlier versions apply to research done while they were in force. Questions about the policy can go to security@sectratek.com.

SectraTEK is developed and distributed by Prudential Associates.

UpDownto moveEnterto openEscto close