Report a security vulnerability

If you believe you have found a security vulnerability in Claryon or in any Netralux service, we want to hear from you. We read every report, we answer every reporter and we will not pursue legal action against anyone acting in good faith under this policy.

How to report

Email security@netralux.ai. If you would rather encrypt your report, our public key is published at our key server entry.

Please tell us what you found, where you found it and how we can reproduce it. Product version, configuration and a short sequence of steps help us far more than a scanner report. Screenshots and short recordings are welcome. Write in English or German, whichever you prefer.

Please do not open a public issue, post the details publicly or share them with anyone else before we have had the chance to fix the problem.

What this policy covers

• The Claryon appliance and every service that runs on it.
• The Netralux cloud services a Claryon appliance talks to, including activation, licensing and update delivery.
• This website and any other website we publish under netralux.ai.

What is out of scope

Some kinds of testing put other people at risk, so we ask you not to do them. Reports about the following will be closed without a fix, though we will still reply:

• Denial of service testing, load testing or anything else designed to degrade a service for other users.
• Social engineering, phishing or any approach directed at our staff, our customers or our suppliers rather than at our systems.
• Physical attacks against offices, hardware or people.
• Vulnerabilities in third-party services we merely use. Please report those to the party that runs them. Tell us as well if a Netralux product is what exposes the problem.
• Findings with no realistic security impact, such as a missing hardening header on a page that carries nothing sensitive, or output from an automated scanner with nothing behind it.

What we promise

• We acknowledge your report within 3 business days. A person reads it, not an autoresponder.
• We give you a triage verdict within 10 business days — whether we consider it a vulnerability, how severe we think it is and what we intend to do about it. If we disagree with you we will say why.
• We publish an advisory when a fix ships, or at 90 days, whichever comes first. If a fix is going to take longer than 90 days we will tell you before that date and agree a new one with you rather than let the clock run out in silence.
• We keep you updated as the fix moves, without you having to chase us.

Safe harbour

When you conduct vulnerability research according to this policy, we consider that research to be:

• Authorised in view of any applicable anti-hacking laws. We will not initiate or support legal action against you for accidental, good-faith violations of this policy.
• Authorised in view of relevant anti-circumvention laws. We will not bring a claim against you for circumventing technological controls.
• Exempt from any restriction in our terms that would otherwise interfere with security research. We waive those restrictions to that limited extent.
• Lawful, helpful to the overall security of the internet and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If a third party brings legal action against you and you have complied with this policy, we will make it known that your actions were conducted in compliance with it.

Please only ever test against systems that are yours. Do not access, change or keep data that belongs to anyone else. If you come across customer data by accident, stop, tell us and delete what you have.

Credit

We name the people who report to us. When we publish an advisory it credits you by the name or handle you ask for, and links wherever you would like it to. Tell us if you would rather stay anonymous and we will say the report came from an independent researcher instead. We will not name you before the advisory is public.

We do not run a paid bug bounty. We would rather be honest about that up front than imply a reward that is not there.

Last updated 7 September 2026. Machine-readable contact details are published at /.well-known/security.txt.