Responsible Disclosure – Cybersecurity Products and Consulting

Guidelines for reporting a security vulnerability

If you believe you have discovered a vulnerability in an Akouto product, system or web-facing property, please submit a vulnerability report via email to info [at] akouto.com. Please note, Akouto does not operate a public bug bounty program and we make no offer of reward or compensation in exchange for submitting potential issues.

PGP Key:

Please do not publicly disclose these details without contacting Akouto first, and without expressed prior written agreement from Akouto.

Akouto Disclosure Policy

Security is the primary goal at Akouto, and we are committed to keeping our customers safe . One of the ways we work to achieve this goal is by using a Secure Development Lifecycle process to integrate security into our products from design, through development and release.

Sometimes, even our best efforts escape detection, or new exploits are released after the product is already on the market. While we work to minimize these occurrences, we are also prepared to respond quickly to resolve them.

At Akouto we are committed to investigate all received vulnerability reports and implement the quickest and best course of action in order to protect our customers. We invite all security researchers that discover a security vulnerability in our products, to share this information with us in a responsible manner. If a verified vulnerability in compliance with Akouto’s Responsible Disclosure Policy is identified, Akouto commits to:

Respond promptly within 48 business hours to acknowledge receipt of any vulnerability reports, working closely with security researchers to understand the nature of the issue and work on timelines for fix/disclosure together.
Provide prompt notification when the vulnerability is resolved, so that it can be re-tested and confirmed as remediated.

Akouto supports responsible disclosure, and we take responsibility for disclosing product vulnerabilities to our customers. In our ongoing efforts to encourage responsible disclosure, we ask that all researchers comply with the following Responsible Disclosure Guidelines:

Provide Akouto with an opportunity to correct vulnerability within a reasonable time frame before publicly disclosing the identified issue, in order to ensure that Akouto has developed and thoroughly tested a patch and made it available to licensed customers at the time of disclosure.
Make a good faith effort to avoid privacy violations as well as destruction, interruption or segregation of our services.
Not modify or destroy data that does not belong to you.

Guidelines for responsible disclosure suggest that customers have an obligation to patch their systems as quickly as possible. It is routine to expect patching to be completed within 30 days after release of a security patch or update.

Akouto advises its customers that those who exploit security systems often do so by reverse engineering published security updates, and therefore encourages its customers to patch systems in a timely manner.

The responsibility for adhering to this policy and reviewing the effectiveness of actions taken to respond to concerns raised under this policy is overseen by Akouto’s senior management team. Various officers of Akouto have routine operational responsibility for this policy, and must ensure that all managers and other staff who may deal with concerns or investigations under this policy receive regular and appropriate training.

Permitted Research

Akouto is grateful for your responsible disclosure should a vulnerability be discovered, however we do not authorize any activities to scan for or exploit vulnerabilities on any production systems or applications.