Security
Vulnerability disclosure policy
Black Shard welcomes reports of security vulnerabilities in Jetstone from anyone. Reports are answered by the people who build it.
Report a vulnerability
Email info@blackshard.com.au with “Security report” in the subject. Include the affected host or component, the steps to reproduce, what an attacker gains, and your workspace id if you tested in your own workspace. Proof of concept code is welcome; screenshots of other people’s data are not. Write in English. There is no bounty.
What we do
- Acknowledge the report within 2 business days.
- Confirm or rule out the issue, with a severity, within 5 business days.
- Send an update at least every 10 business days until it is fixed.
- Credit you in the release notes once it is fixed, if you want to be named.
Fix targets
| Severity | Fixed within |
|---|---|
| Critical (9.0 to 10.0) | 7 days |
| High (7.0 to 8.9) | 30 days |
| Medium (4.0 to 6.9) | 90 days |
| Low (0.1 to 3.9) | 180 days |
You may publish 90 days after the report, or once the fix ships if that is sooner, unless we agree another date with you. Customers whose data was exposed are told under the Notifiable Data Breaches scheme where it applies.
In scope
- getjetstone.com and console.getjetstone.com
- agents.getjetstone.com, the device API the agent uses
- The Jetstone agent for Windows and its installer
- The Jetstone mobile and desktop apps
- The signed update channel and the detection content pack
Out of scope
- Denial of service, load testing and anything that degrades the service for customers
- Social engineering of Black Shard staff or customers, and physical attacks
- Services Jetstone uses but does not run, such as Stripe, Microsoft 365 and Microsoft Azure: report those to their owners
- Findings from automated scanners with no shown impact, missing headers on pages that hold no data, and clickjacking of pages with no action
- Workspaces, devices or accounts that are not your own, unless the owner has agreed in writing
Rules for research
- Test only against a workspace you own or one whose owner has agreed in writing.
- Stop as soon as you reach data that is not yours, read no more of it, and tell us what you reached.
- Keep no customer data. Delete anything you obtained once the report is made.
- Do not run destructive tests, change other customers’ data, or leave anything behind on a device.
- Keep the finding private until it is fixed or the disclosure period has passed.
Good-faith research
Research that follows this policy is authorised by Black Shard. We will not take legal action against you or report you to law enforcement for it, and we will say so to anyone who asks. If a third party brings a claim over research that followed this policy, we will make it known that the work was authorised.
Version 2026-11-01.