Coordinated vulnerability disclosure¶
Scope¶
HodeiShield (the console at app.hodeishield.com, the documentation, the public API and MCP endpoints) and the products Hodeitek SL manufactures:
- the HodeiShield endpoint agent on Linux, Windows and macOS, and its enroll, ingest and update endpoints, which are part of the product's remote data processing;
- the command-line tool.
How to report¶
Write to security@hodeitek.com. This is the single point of contact
for vulnerability reports and matches the security.txt published on every host
(/.well-known/security.txt). Reports are accepted in Spanish, English, German, French, Italian
and Basque. Encrypted email (PGP) is not offered.
Reports about the endpoint agent go by email only: GitHub private vulnerability reporting does not apply to the agent, because its repository is private. For the public repositories of the command-line tool you may also use GitHub private vulnerability reporting (the repository's Security tab, Report a vulnerability); email remains valid.
Please include what you found, where, the steps to reproduce it, its likely impact, and the affected version and platform. Do not include real customer data or real keys or tokens; stop as soon as you have shown the issue.
What you can expect¶
| Step | Target |
|---|---|
| Acknowledgement of your report | within 3 business days (target) |
| First assessment and severity | within 10 business days (target) |
| Status updates | at least every 14 days until resolved |
| Fix and public advisory | coordinated with you; public disclosure at 90 days |
Fix targets¶
We rate severity with CVSS v3.1 and you may comment on the rating. The targets for shipping a fixed release are counted from the first assessment:
| Severity | Fix target |
|---|---|
| Critical | 7 days |
| High | 30 days |
| Medium | 90 days |
| Low | in the next release |
Disclosure¶
We ask you to keep the vulnerability confidential until the advisory is published, and we agree the date with you. Public disclosure happens 90 days after your report. If no fix is available by then, we publish the advisory with the workarounds we know of. If the vulnerability is being actively exploited, we may publish earlier, with workarounds.
The targets are goals, not contractual guarantees. Confirmed vulnerabilities are fixed and, where appropriate, published: for the command-line tool, as a GitHub Security Advisory; for the endpoint agent, in the release notes and on this documentation site (with a CVE when one is assigned). Where a vulnerability is actively exploited or causes a severe incident, Hodeitek also notifies the competent authorities within the legal deadlines (Regulation (EU) 2024/2847, art. 14).
Good faith¶
If you act in good faith, stay within scope, avoid privacy violations, data destruction and service degradation, and give us reasonable time to fix the issue, Hodeitek will not start legal action against you for your research.
Out of scope¶
Denial-of-service testing, social engineering of staff or customers, physical attacks, and reports produced only by automated scanners without a demonstrated impact.
Recognition¶
There is no bug bounty. With your consent, we credit you publicly in the advisory.