How to report
Send the report to security@enquanta.com. The mailbox reaches EnQuanta’s security and legal leads directly, not a ticket queue.
OpenPGP: [key fingerprint to be published]. Until the key is published, send the report in plain text; if the details are sensitive, say so in the first message and an encrypted channel is arranged before anything further is exchanged.
The machine-readable contact record is enquanta.com/.well-known/security.txt (RFC 9116).
What to include
The product or domain concerned, and the version, build or date you tested.
The type of vulnerability and the steps to reproduce it: a proof of concept, a request and response, or a minimal script.
The impact as you see it: what an attacker could reach or do.
Whether anyone else knows about the finding.
How you would like to be credited in the advisory, or that you prefer not to be.
What to expect
An acknowledgement within two business days of receipt. Reports are handled under EnQuanta’s incident response plan: the security lead confirms the finding, assigns a severity, and keeps the reporter informed of the fix target and the publication date.
Remediation targets by severity, as EnQuanta’s vulnerability management policy sets them. Severity follows CVSS or the rating of the affected component, and a vulnerability that is being exploited counts as critical. The first figure applies to internet-facing components and to identity and cryptographic components, the second to internal components.
Critical, or actively exploited: 72 hours for internet-facing, identity and cryptographic components; 7 days for internal components.
High: 14 days for internet-facing, identity and cryptographic components; 30 days for internal components.
Medium: 30 days for internet-facing, identity and cryptographic components; 90 days for internal components.
Low: the next maintenance window for internet-facing, identity and cryptographic components; the next quarterly review for internal components.
A target that cannot be met is recorded with its reason and an expiry date, and the reporter is told.
Coordinated publication
EnQuanta publishes an advisory once a fix or mitigation is available and agrees the date with the reporter. Reporters are asked not to publish details before then; after publication they are free to discuss their work and are credited in the advisory if they wish. A CVE identifier is requested where the finding warrants one.
Safe harbour
Security research conducted in good faith under this policy is authorised. EnQuanta will not take or support legal action against a researcher for research that:
stays within the scope below;
accesses only the data needed to demonstrate the finding and exfiltrates, modifies or destroys none of it; if personal or customer data is encountered, the researcher stops and reports;
does not disrupt a service: no denial of service, no load testing, no brute force beyond what a single demonstration requires;
uses no social engineering, phishing or physical intrusion against EnQuanta staff, customers or facilities;
reports the finding promptly and keeps it confidential until the coordinated publication.
If a third party brings action over research that respected these terms, EnQuanta will make it known that the research was authorised. Research that goes beyond them is not covered.
Scope
enquanta.com and its subdomains.
The product domains, including quantaview.com and quantatrust.net.
The software EnQuanta ships: QuantaView (the console, the Endpoint Client and the on-premise bundle), the QuantaCrypt SDK and its language bindings, QuantaCrypt Storage and Vault, QuantaPass and QuantaTrust.
A finding in a customer’s own deployment is reported to EnQuanta as well, so the fix reaches every customer; testing a customer’s instance needs that customer’s permission.
Out of scope
Third-party services EnQuanta uses but does not operate (hosting, DNS, mail delivery, analytics): report those to the provider.
Findings that require a victim’s compromised device or account, social engineering, or physical access.
Reports without a demonstrated impact: missing best-practice headers, version banners, and the like.
Denial of service.
Security advisories
Advisories for fixed vulnerabilities in EnQuanta products are published on this page: what the vulnerability is, the affected products and versions, the impact and severity, and the fix or mitigation. The list starts with the first advisory; none has been published yet.