Security & responsible disclosure

S.R.E Manufacturing and Trading P.L.C. · this page is referenced from /.well-known/security.txt

What is in scope

• cyberguard.et and classroom.cyberguard.et, including every /api/ endpoint.
• The shipped product: the console, the shipper, the inline WAF, the compiled packages.
• The AI Cyber Guard phone app for Android.

What we ask

• Do not access, change or delete data that is not yours. Prove the flaw with the minimum needed.
• No denial of service, no social engineering of our staff, no physical attacks.
• The Attack School is a defensive range: its samples are lessons, not targets. Attacking students or their systems through it is out of scope and against the Terms.
• Give us a reasonable time to fix before publishing. We aim to acknowledge within 2 working days, triage within 7, and fix critical issues within 30.

What you can expect

• A named person replies, not a form. You will know what we found and when it shipped.
• Credit on this page if you want it. We do not currently pay bounties; we say so rather than imply otherwise.
• Safe harbour: research that follows this policy is authorised, and we will not take legal action over it.

How the product is built to be examined

• Detection and blocking are deterministic and rule-based; no model has a vote in a block decision, and a test enforces that.
• Every administrative action is written to a hash-chained audit log; cyberguard-admin audit-verify names the first tampered row.
• Release packages are signed (ssh-keygen -Y) and ship with an SBOM; the installer verifies the signature when present.
• Two-factor authentication for the console; secrets and second-factor seeds encrypted at rest; per-machine ingest keys.
• The product runs fully air-gapped, including its AI analyst, on the customer's own hardware.