Responsible disclosure

Email security@direwolfcybersecurity.com. Our contact details are also published in machine-readable form at /.well-known/security.txt (RFC 9116). Please do not report vulnerabilities through the contact form, social media or a customer account.

Please include:

• the affected URL, host or component, and the type of issue;
• step-by-step instructions to reproduce it, with any proof-of-concept code or requests;
• the impact as you understand it, and any conditions required (for example a user role);
• how you would like to be credited, if at all, and whether we may contact you with questions.

Please do not send customer data, personal information you encountered, credentials or secrets; a description is enough. We do not yet publish a PGP key; if you need to send something sensitive, ask us for a secure channel first.

To stay within this policy:

• Test only against accounts and data you own or are explicitly authorized to test. Create your own test accounts; do not use a customer’s.
• Do not access, modify, delete, download or retain data that is not yours. If you encounter another organization’s or person’s data, stop, do not look further, and tell us in your report.
• Do not degrade the service: no denial of service, no high-rate automated scanning, no spam, and no actions that would interrupt our customers’ security monitoring.
• Do not use social engineering, phishing or physical attacks.
• Take only the steps needed to demonstrate the issue. Prove a vulnerability exists; do not exploit it further.
• Give us reasonable time to fix the issue before disclosing it publicly. We ask for 90 days from your report, or until the fix is released if sooner, and we will coordinate disclosure with you.
• Do not demand payment as a condition of reporting or of withholding disclosure.

If you make a good-faith effort to comply with this policy during your security research, we consider your research authorized under the Computer Fraud and Abuse Act (18 U.S.C. 1030) and applicable state computer-crime law, exempt from the anti-circumvention provisions of the Digital Millennium Copyright Act (17 U.S.C. 1201), and exempt from restrictions in our Terms of Service and Acceptable Use Policy that would interfere with it. We will not pursue or support legal action against you for research conducted in accordance with this policy.

This authorization applies only to systems in scope above and does not extend to systems operated by others, including our vendors and our customers. It does not authorize accessing, retaining or disclosing personal information or customer data, disrupting the service, or any activity outside the rules above. If you are unsure whether something is covered, ask us at security@direwolfcybersecurity.com before you proceed.

This statement reflects the U.S. Department of Justice’s policy of declining to prosecute good-faith security research and the safe-harbor norms published by the security research community. It is our policy, not legal advice to you.

For how the Direwolf Platform is built and protected, see the Platform page. For our compliance posture, including exactly what we do and do not claim, see Compliance. Customers and their assessors can ask about our customer responsibility matrix, which we are completing as controls are implemented, through the contact page.

Policy version v2026.10.24. Changes to this policy are published with a new version.