Last Updated SOctober 6, 2026

‍

‍

1. Introduction and Purpose

‍

Infrared Security, LLC d/b/a Endura Security ("Endura," "Endura Security," "we," "us," or "our") values the work of security researchers and the broader security community. This Vulnerability Disclosure Policy ("Policy") explains how to report a security vulnerability in Endura's websites, software, and services, what you can expect from us in return, and the conditions under which we authorize good-faith security research. We encourage anyone who believes they have found a vulnerability affecting the security of Endura, our customers, or our users to report it to us.

‍

2. Scope

‍

2.1 In Scope

‍

This Policy applies to the following Endura-controlled assets:

• the Endura website at https://www.endurasecurity.com and subdomains operated by Endura, including docs.endurasecurity.com and repo.endurasecurity.com;
• Endura-managed Team Server environments operated by Endura;
• Runtime Sensor and Team Server software distributed by Endura;
• Endura's public APIs and integrations; and
• software packages, installers, and artifacts published by Endura.

‍

2.2 Out of Scope

‍

The following are outside the scope of this Policy:

• customer self-hosted Team Server deployments and customer-operated Runtime Sensor installations, which run on infrastructure the applicable customer controls (report suspected issues in those environments to the operating customer, who may coordinate with Endura);
• third-party services, platforms, and hosting providers that Endura does not operate (report those issues to the responsible provider);
• findings that require physical access to Endura facilities or hardware;
• social engineering of Endura personnel, customers, or vendors; and
• denial-of-service testing and volumetric or resource-exhaustion attacks.

‍

3. Authorization and Safe Harbor

‍

Endura considers security research and vulnerability disclosure conducted in accordance with this Policy to be authorized conduct. For activity that follows this Policy, Endura will not pursue or support legal action against you, including under the U.S. Computer Fraud and Abuse Act or the Digital Millennium Copyright Act, and will not report the activity to law enforcement, provided that you:

‍

• act in good faith and comply with this Policy;
• stay within the systems and services identified as in scope;
• avoid privacy violations, data destruction, service degradation, and disruption to Endura, its customers, and its users;
• access, use, and retain only the minimum data necessary to demonstrate a vulnerability; and
• give Endura reasonable time to investigate and remediate before any public disclosure.

If a third party initiates legal action against you for activity conducted in accordance with this Policy, Endura will make this authorization known, to the extent it can. This Policy does not authorize activity that violates applicable law, and it does not grant authorization to test systems operated by Endura's customers or by other third parties.

‍

4. How to Report

‍

4.1 Reporting Channel

‍

Report vulnerabilities by email to security@endurasecurity.com. If you wish to encrypt your report, request our PGP public key at that address before sending sensitive details.

‍

4.2 What to Include

‍

To help us validate and resolve the issue quickly, please include:

• a description of the vulnerability and its potential impact;
• the affected asset, URL, software version, or component;
• the steps required to reproduce the issue, including any proof-of-concept code, requests, or screenshots;
• any configuration or conditions required to trigger the behavior; and
• the name or handle you would like to be credited under, if any.

Where possible, please submit reports in English.

‍

5. What to Expect From Endura

‍

When you submit a report in accordance with this Policy, Endura will aim to:

• acknowledge receipt within three (3) business days;
• provide an initial assessment of validity and severity within ten (10) business days;
• keep you informed of remediation progress at reasonable intervals; and
• notify you when the reported vulnerability has been resolved.

These timelines are targets rather than guarantees and may vary with the complexity and severity of a report. Endura prioritizes remediation based on risk.

‍

6. Researcher Guidelines

‍

To keep research safe for everyone, you agree that you will not:

• access, modify, delete, or exfiltrate data that does not belong to you;
• intentionally degrade, disrupt, or deny Endura services;
• run automated scanning at a volume that may harm availability;
• test or attack customer self-hosted or customer-operated deployments without that customer's authorization;
• use social engineering, phishing, or physical intrusion;
• install persistent access or leave any system in a less secure state; or
• publicly disclose a vulnerability before Endura has resolved it or before a mutually agreed date.

If you inadvertently encounter data belonging to Endura customers or other individuals, stop, do not retain or share it, and describe the situation in your report.

‍

7. Coordinated Disclosure

‍

Endura follows a coordinated disclosure approach. We ask that you keep the details of any reported vulnerability confidential until Endura has released a fix or mitigation, or until a disclosure date mutually agreed with you. Absent a mutually agreed date, we ask that you allow up to ninety (90) days from acknowledgment before public disclosure. We are glad to coordinate timing and public credit with you.

‍

8. Recognition

‍

Endura does not currently operate a paid bug bounty program. With your permission, we are glad to acknowledge researchers who report valid, previously unknown vulnerabilities and who follow this Policy. Please tell us in your report whether, and how, you would like to be credited.

‍

9. Out-of-Scope Report Types

‍

Unless accompanied by a demonstrable security impact, the following are generally not accepted as vulnerabilities:

• missing security headers or cookie flags without a working exploit;
• reports generated solely by automated tools without validation;
• clickjacking on pages that carry no sensitive actions;
• rate-limiting or brute-force findings without demonstrated impact;
• software version disclosure without an associated vulnerability;
• issues that require an already-compromised account or device; and
• best-practice suggestions without a concrete security risk.

‍

10. Relationship to Other Agreements

‍

This Policy governs vulnerability reporting and authorized security research only. It does not modify the Endura Terms and Conditions, Privacy Policy, or any Order, Service Agreement, or Data Processing Agreement. Obligations relating to customer-managed deployments remain governed by those agreements.

‍

11. Changes to This Policy

‍

Endura may update this Policy from time to time. When we make changes, we will update the "Last Updated" date above. The version published on this page governs research conducted after its effective date.

‍

12. Contact

‍

Security reports and questions about this Policy may be sent to:

‍

security@endurasecurity.com

‍

Infrared Security, LLCd/b/a Endura Security
18376 Southampton Drive
Lewes, DE 19958
United States

‍

We appreciate the security researchers who help keep Endura and its users safe.

‍