Email us, privately.
Email us
Write to security@altiward.com with “Security report” in the subject. Please don't open a public issue or post details until it's fixed.
Tell us what you found
The version of the agent or server, the steps to reproduce it, and what an attacker could do with it.
We work on it with you
We aim to reply within five working days, keep you posted while we fix it, and agree with you when to publish. We ask for up to 90 days.
What to test, and what not to.
In scope
The Altiward agent on macOS, including its tamper checks and how it records and removes admin rights. A way to stop or bypass the agent without it going on record is exactly what we want to hear about.
The Altiward server and console: the API, the console, sign-in, and delivery to SIEMs.
altiward.com, this website.
Out of scope
Someone else's Altiward server. Customers run their own servers, and we can't give permission to test them. Test an installation you run yourself.
SAP Privileges itself. Report those to SAP, through the SAP Privileges repository.
Denial of service, spam, social engineering and physical attacks.
Releases aren't public yet. Ask us for one.
If you'd like to test the agent or the server, email us and say what you'd like to look at. We'll send you a release to run on your own Mac and infrastructure.
What you can expect from us.
- Good faith
- If you act in good faith and follow this page, we won't take legal action against you for your research.
- Credit
- With your permission, we'll credit you in the release notes for the fix.
- No paid bounty
- There's no paid bug bounty right now.
Altiward is in early access.
Early access is for Mac teams who already deploy SAP Privileges through an MDM such as Jamf or Intune.