Report a vulnerability
Last updated:
If you find a security vulnerability in Manager or on this website, please report it to us privately.
Where to report
Email security@manager-agent.com, in English or German.
What to include
- The affected product (hosted service, desktop app or server) and its version, if you know it.
- Steps to reproduce, and a proof of concept if you have one.
- The impact as you see it.
- Whether you want to be credited.
What happens next
- We confirm receipt within 3 working days.
- Within 10 working days we send you our assessment and what we plan to do.
- We keep you updated until the fix ships and agree with you when to publish.
- If you want, we credit you in the release notes.
We do not run a bug bounty and do not pay for reports.
Good-faith research
We will not take legal action against research done in good faith that follows these rules:
- Test only with your own accounts and data. If you reach someone else’s data, stop, keep no copy, and tell us.
- No denial-of-service, spam or high-volume scanning.
- No social engineering and no physical attacks.
- Do not publish before the fix ships or 90 days have passed, whichever comes first.
Scope
The hosted service, the desktop app, the server and this website. A misconfigured self-hosted installation is a matter for whoever runs it.