Reporting a vulnerability
If you believe you have found a security problem in SQAT Data Governance, please tell us privately so we can fix it before anyone misuses it. Email security@sqat.farm.
Please include:
- what the problem is and what someone could do with it;
- the page or API address, and the steps to reproduce it;
- how to contact you, and whether you would like to be credited.
What is in scope
This application (the SQAT Data Governance web app) and its API. Out of scope: the external sign-in providers, SQAT partners' own systems, denial-of-service or load testing, and social engineering of people.
What we ask of you
- Act in good faith, and use only test accounts or your own data.
- Do not view, change or delete other people's data beyond the minimum needed to show the problem. If you do see personal data, stop, keep no copy, and tell us.
- Do not degrade the service for others.
- Give us reasonable time to fix the problem before you publish anything. We suggest 90 days, and we will agree a date with you.
What we will do
- Acknowledge your report within 5 working days, and keep you informed until it is resolved.
- Credit you when the fix is announced, if you wish.
- Not take legal action against research carried out in good faith under this policy.
- If personal data was exposed, handle it as a personal data breach under GDPR Article 33 and the SQAT data governance incident procedure (D4.2).
Security updates
Security fixes are supported until , the end of the SQAT project (Horizon Europe grant 101129644). Support after that will be set by the SQAT operations plan (D6.4). This is a hosted service: only the latest release runs, so fixes reach every user without any action on their part.
Software bill of materials
Every build carries a software bill of materials (SBOM) in the CycloneDX format, listing each component with its version and licence. Signed-in users can download it from the Help page. Anyone else can request it at the address above.
About security.txt
/.well-known/security.txt is a small text file,
defined by the internet standard RFC 9116, that tells security researchers and their tools where to
report a vulnerability. It gives the contact address, a link to this policy, and an expiry date after which
its details should no longer be trusted.
Current expiry:
.