# Tell us about a security issue

Report a vulnerability · DataBridge by Walnut

<https://walnut.sg/security/disclosure/>

How to report a security issue in this website or in the DataBridge software, what to include, and what happens after you write to us.

If you find a security issue in this website or in the DataBridge software, we want to hear about it, and we work with you to fix it.

## [What this policy covers](https://walnut.sg/security/disclosure/#scope-head)

This website.

The contact form and the endpoint behind it, which take messages from visitors.

The DataBridge software, on an installation you own or have the owner's written permission to test.

Social engineering, physical attacks and denial of service are outside this policy.

## [How to report an issue](https://walnut.sg/security/disclosure/#report-head)

Write to outreach@walnut.sg.

## [What to put in your report](https://walnut.sg/security/disclosure/#include-head)

What you found.

Where you found it.

The steps to reproduce it.

What someone could do with it.

## [What happens after you write](https://walnut.sg/security/disclosure/#timeline-head)

We aim to acknowledge your report within two working days. We then agree a disclosure date with you, 90 days after your report by default.

If you would like public credit, we give it.

## [Safe harbour for good-faith research](https://walnut.sg/security/disclosure/#safe-harbour-head)

If you act in good faith and within this policy, we treat your research as authorised and we do not take legal action over it.

Please use your own accounts and test data, avoid disrupting the service, and stop and tell us as soon as you reach data that is not yours.

## [Contact](https://walnut.sg/security/disclosure/#contact-head)

Our security contact is also published at /.well-known/security.txt.