Report a vulnerability
Shuusei AB accepts and coordinates reports of security vulnerabilities in DatumHue: the workstation, on a computer and in the browser, the server components, and the datumhue.app platform.
How to report
To report a vulnerability, write to security@datumhue.com with the version, the steps that reproduce it and its impact.
Name the product, or the datumhue.app platform, the report concerns. A proof of concept helps, and say how you would like to be credited, if at all. Encrypt sensitive reports if you wish: ask for a key at the same address. Do not file vulnerabilities through public channels or ordinary support tickets.
What happens to a report
- Acknowledgement. You receive a reply confirming the report reached a human.
- Assessment. We reproduce and assess the issue and keep you informed of the outcome — including when we conclude it is not a vulnerability.
- Fix. Confirmed vulnerabilities are fixed with priority over
feature work. A fix ships in a new release, through each product's
normal update channel:
- Platform: only the latest release is supported. The free workstation app installs each new release as it starts.
- Enterprise: while your subscription is active, every release is available to you, security fixes included. You decide when to update your deployment, and a fix reaches it when you install the release that carries it.
- Creator Registry: only the latest release is supported. Its launcher applies each new release.
- Coordinated disclosure. We agree on a disclosure timeline with you before publishing. Release notes identify fixed vulnerabilities once a fix is available, and we credit reporters who want credit.
Good-faith research
We do not pursue or support legal action against good-faith security research that respects user data (no accessing, modifying, or destroying data that is not yours), avoids service disruption of the datumhue.app platform, and gives us reasonable time to fix before public disclosure.
Out of scope
- Vulnerabilities in third-party packages published by independent creators — report those to the package's creator; report to us if DatumHue's sandboxing or permission checks fail to contain them.
- Issues requiring physical access to an unlocked, signed-in machine.
Shuusei AB (org. nr 559146-8292) · Hällebergsgatan 36, 442 54 Ytterby, Sweden