Vulnerability Disclosure Policy

SentinelID is a security product, so we would genuinely rather hear about a problem than not. If you have found a vulnerability in our hardware, firmware, APIs, or websites, this page tells you how to report it and what happens next.

How to report

Email casey@sentinel-id.com with enough detail to reproduce the issue. A proof of concept, affected URLs or endpoints, and the impact you believe it has are the most useful things you can include.

If you would prefer to encrypt the report, say so in a first message and we will arrange a key.

What to expect

• Acknowledgement within 3 business days. We are a small team, so this is a person replying rather than a ticketing system.
• An assessment within 10 business days, including whether we agree on severity and a rough remediation timeline.
• Credit if you want it. Tell us how you would like to be named, or say you would rather stay anonymous.

We do not currently run a paid bug bounty. We will not pretend otherwise to attract reports.

Safe harbour

If you make a good faith effort to follow this policy, we will not pursue or support legal action against you for your research. Good faith means: you avoid privacy violations, service degradation, and destruction of data; you only interact with accounts you own or have explicit permission to test; and you give us reasonable time to fix an issue before disclosing it publicly.

In scope

• The SentinelID MK1 module and its firmware
• The device identity, provisioning, and verification APIs
• sentinel-id.com, dashboard.sentinel-id.com, and the documentation site
• The publisher dashboard and the companion application

Out of scope

Reports that are almost always noise rather than findings: missing security headers with no demonstrated impact, results from an automated scanner with no working proof of concept, denial of service through sheer volume, social engineering of our staff or customers, and issues in third party services we do not operate.

Physical attacks on a module you own are in scope to report, but note that drilling your own device yields only your own already banned identity, which is a documented property of the design rather than a vulnerability.

Public disclosure

Please give us 90 days before publishing, or less if we have already shipped a fix and confirmed it with you. If we go quiet on you, that is our failure and not a reason for you to stay quiet indefinitely. Tell us you intend to publish and we will respond.