Vulnerability disclosure policy. How we work with researchers.

This policy applies to security research relating to assets that are owned, operated, maintained, manufactured, or supplied by Newmanry Labs, including:

• Newmanry Labs websites, domains, subdomains, APIs, portals, and cloud-hosted services;
• Newmanry Labs applications, software, firmware, and update mechanisms;
• Newmanry Labs hardware products, appliances, and product management interfaces;
• Newmanry Labs product documentation, configuration templates, and deployment tooling where a security issue could affect customers or users; and
• Any other digital asset, product, or service that Newmanry Labs has expressly identified as being in scope.

Testing must be limited to assets and products that you own, lawfully possess, or have explicit permission to test. For products deployed in a customer, partner, government, or third-party environment, you must obtain permission from the owner or operator of that environment before testing.

If you are unsure whether a system, service, or product is in scope, please contact us through the official channel before conducting further testing.

The SilentGlass product line is in scope for vulnerability reports under this policy. SilentGlass is technology and intellectual property licensed from the UK National Cyber Security Centre, and vulnerability reports relating to SilentGlass will require coordinated handling with the UK NCSC.

By submitting a vulnerability report relating to SilentGlass, you acknowledge that Newmanry Labs will share relevant report details, supporting technical information, remediation status, and related communications with the UK NCSC where necessary for investigation, remediation, coordinated disclosure, licence compliance, security assurance, or protection of users and customers.

Where practical and appropriate, we will tell you when UK NCSC coordination applies. We do not expect researchers to report separately to the UK NCSC unless we specifically agree that approach with you or unless you have an independent obligation to do so. We will not ask you to disclose publicly before coordinated handling has taken place.

The following are out of scope unless Newmanry Labs has given explicit written permission:

• Assets, systems, networks, products, or equipment not owned, operated, maintained, manufactured, or supplied by Newmanry Labs;
• Customer, partner, supplier, government, or third-party environments, even where they use Newmanry Labs products;
• Physical attacks against Newmanry Labs offices, staff, suppliers, customers, or infrastructure;
• Social engineering, phishing, vishing, smishing, pretexting, or impersonation;
• Denial-of-service, resource exhaustion, stress testing, load testing, or actions likely to degrade service availability;
• Spam, credential stuffing, brute force, password spraying, or high-volume automated testing;
• Malware, ransomware, destructive payloads, persistence mechanisms, botnets, or command-and-control infrastructure;
• Attempts to access, modify, delete, encrypt, exfiltrate, or disclose data that is not necessary to prove the vulnerability;
• Attacks against third-party services, hosting providers, networks, dependencies, or integrations that Newmanry Labs cannot authorise; and
• Findings based solely on outdated software version banners, missing security headers, TLS configuration observations, or low-impact best-practice recommendations without a demonstrable security impact.

Vulnerabilities discovered or suspected in out-of-scope systems should be reported to the appropriate vendor, owner, operator, or applicable authority.

When you work with us in good faith and in accordance with this policy, you can expect us to:

• Acknowledge receipt of your report within 5 working days where practicable;
• Review and triage your report in a reasonable timeframe based on severity, complexity, and operational constraints;
• Work with you to understand, reproduce, and validate the issue where needed;
• Keep you reasonably informed about the status of the vulnerability as it is processed;
• Treat your report and your communications with respect and confidentiality;
• Remediate validated vulnerabilities in a timely manner, taking into account severity, exploitability, customer impact, product complexity, and deployment constraints;
• Tell you when the issue has been remediated or when we determine that no remediation is required;
• Support coordinated public disclosure where appropriate once the issue has been resolved or mitigated;
• Attribute your discovery if you would like recognition, subject to legal, contractual, security, and privacy constraints; and
• Extend safe harbour for vulnerability research that is conducted in good faith and in accordance with this policy.

Newmanry Labs does not currently operate a paid bug bounty programme. Submitting a report under this policy does not create an entitlement to payment, reward, compensation, employment, contract work, or any other financial benefit.

We do, however, value good-faith vulnerability reports. Where appropriate, and with your permission, we may recognise your contribution through:

• Public acknowledgement on our security acknowledgements page, release note, advisory, or similar communication;
• Private written thanks from Newmanry Labs;
• Coordinated attribution in a public disclosure; or
• Other non-monetary recognition at our discretion.

We will not publicly identify you without your permission unless required by law or applicable authority.

In participating in this vulnerability disclosure process, we ask that you:

• Act in good faith and follow this policy;
• Report any vulnerability you discover promptly through the official channel;
• Use only the official channel to discuss vulnerability details with us until coordinated disclosure has taken place;
• Perform testing only on in-scope systems, services, or products that you are authorised to test;
• Avoid harm to people, customers, users, systems, services, data, or infrastructure;
• Avoid disrupting, degrading, damaging, or interrupting Newmanry Labs systems, services, products, or customer operations;
• Do not access, modify, delete, copy, retain, disclose, or exfiltrate data except for the minimum amount strictly necessary to demonstrate the vulnerability;
• Stop testing and report immediately if you encounter personal data, customer data, confidential information, credentials, secrets, cryptographic keys, commercially sensitive information, or other data that does not belong to you;
• Interact only with accounts, devices, systems, and data that you own or have explicit permission to use;
• Do not use a discovered vulnerability to pivot into other systems, escalate access beyond what is necessary to demonstrate impact, establish persistence, or conduct further unauthorised activity;
• Preserve confidentiality of vulnerability details until coordinated disclosure has been agreed or the disclosure timeline below has expired;
• Do not engage in extortion, threats, coercion, or demands for payment; and
• Comply with all applicable laws and regulations.

If you are uncertain whether an activity is permitted, please contact us through the official channel before proceeding.

We ask that you give us a reasonable opportunity to investigate and remediate reported vulnerabilities before public disclosure.

Unless otherwise agreed, we ask that you wait at least 90 calendar days from the date of your initial report before publicly disclosing vulnerability details. We may ask for additional time where remediation is complex, involves customer deployments, requires coordination with third parties or authorities, or relates to the SilentGlass product line and requires coordination with the UK NCSC.

We will not use requests for additional time to delay disclosure indefinitely. Where public disclosure is appropriate, we will work with you to coordinate timing, content, attribution, and any customer or authority notifications.

If a vulnerability is being actively exploited or presents a serious and imminent risk, we may need to accelerate remediation, customer notification, authority notification, or public communication.

For the purposes of this policy, the official channel for reporting vulnerabilities is security@newmanrylabs.com.

If your report contains sensitive technical details, secrets, personal data, customer information, or information that may affect live systems, please tell us in your initial email and we will agree an appropriate secure method for sharing further details. Where available, please encrypt sensitive reports using our published PGP public key at https://newmanrylabs.com/.well-known/security-pgp.asc (fingerprint B143 ACF7 54FB FF7A 76C8 2033 7122 8589 54CB 57A8).

Please include as much relevant information as you reasonably can, such as:

• Affected asset, product, version, firmware version, URL, API endpoint, or component;
• Vulnerability type and a clear description of the issue;
• Steps to reproduce the issue;
• Proof-of-concept code, screenshots, logs, request and response examples, or other supporting evidence;
• Potential impact and any known exploitability considerations;
• Whether you believe customer, personal, confidential, or sensitive data may be affected;
• Whether the issue relates to the SilentGlass product line;
• Your preferred contact details;
• Whether you would like public attribution; and
• Any proposed disclosure timeline or publication plans.

Please do not include unnecessary personal data, customer data, secrets, credentials, or sensitive information in your report.

When conducting vulnerability research in accordance with this policy, Newmanry Labs considers your research to be authorised, conducted in good faith, and helpful to the security of Newmanry Labs, our customers, our users, and the wider community.

For vulnerability research conducted in good faith and in accordance with this policy, Newmanry Labs will not initiate or support legal action against you for accidental, good-faith violations of this policy.

Newmanry Labs considers such research to be:

• Authorised for the purposes of applicable anti-hacking laws, to the extent Newmanry Labs is able to provide such authorisation;
• Authorised for the purposes of applicable anti-circumvention laws, to the extent Newmanry Labs is able to provide such authorisation;
• Exempt from restrictions in Newmanry Labs Terms of Service, Acceptable Use Policy, or similar terms that would otherwise interfere with good-faith security research under this policy, and those restrictions are waived on a limited basis for that purpose; and
• Lawful, helpful, and conducted in good faith when performed within the boundaries of this policy.

You are expected to comply with all applicable laws. This safe harbour applies only to legal claims under the control of Newmanry Labs and does not bind independent third parties, customers, partners, suppliers, service providers, authorities, or other organisations.

If legal action is initiated by a third party against you and you have complied with this policy, Newmanry Labs will take reasonable steps, where appropriate and within our control, to make it known that your actions were conducted in compliance with this policy.

If at any time you are concerned or uncertain whether your research is consistent with this policy, please contact us through the official channel before going further.

We will handle vulnerability reports as confidential security information. We may share reports and related information internally with personnel who need to know in order to investigate, validate, remediate, manage risk, or comply with legal, regulatory, contractual, or licence obligations.

We may also share relevant information with affected customers, suppliers, service providers, regulators, law enforcement, the UK NCSC, or other competent authorities where necessary for remediation, risk management, legal compliance, contractual compliance, licence compliance, or protection of users and customers.

For SilentGlass-related reports, we may share relevant information with the UK NCSC as described above.

Newmanry Labs may update this policy from time to time. The version published on our website at the time of your testing will apply to your research, unless a later version provides broader authorisation or protection.

Questions about this policy should be sent through the official channel: security@newmanrylabs.com.