Tell us before
you tell the world.
We keep watch — and that has to include watching our own systems. If you have found a weakness in anything Warden builds, we want to hear it, and we will not punish you for looking.
Act in good faith under this policy and we will treat your research as authorised. We will not pursue legal action against you, we will not report you, and we will work with you in confidence to understand and fix the issue. Good-faith security research is a service to the public and the crews this software is built for — not a threat.
01 What this covers
In scope
- This website and any Warden-operated web service or API.
- Authentication, access-control, injection and data-exposure flaws.
- Logic flaws that could compromise safety, custody or the audit trail.
- Anything that would let a record be altered without breaking the chain, or let events an anchor covers be changed without the anchor check (both verifiers, the comparison of the record and ledger exports in Verify section 04, and openssl) failing. Known limits, not flaws: whoever holds the ledger key can alter events newer than the latest anchor, and someone with owner rights could rebuild the ledger and its anchors from scratch, which shows only against a copy of an earlier anchor (Verify).
Out of scope
- Denial-of-service, volumetric or load testing of any kind.
- Social engineering, phishing or physical intrusion against people.
- Accessing, modifying or exfiltrating data that is not your own.
- Automated scanner output with no demonstrated impact.
- The platforms of third-party providers we host on, and the time-stamp authority's own service (FreeTSA) — report those to them.
02 How to report
- Write it up.Email joe@wardendfr.com with what you found, where, and the steps to reproduce it. A short proof-of-concept helps.
- Give us room.Hold off on public disclosure until we have had a fair chance to fix it. We will keep you updated the whole way.
- Do no harm.Use only your own test accounts and data. Stop at proof — never pivot, escalate or exfiltrate.
03 Our commitment to you
We aim to acknowledge a report within 2 days, triage and assess it within 10, and coordinate a fix within 90. We will credit you for the find if you would like us to, and we will be honest with you about what we can and cannot fix, and when. Accountability runs in both directions.
04 Why we bother
Anyone building the record a fire service keeps when it flies a camera over the public cannot flinch when someone finds a hole in it. The willingness to be told you are wrong is the whole point of the accountability we build in. This page is the same commitment as everything else Warden stands for, pointed back at ourselves.