Found a vulnerability? Tell us.

In scope

• The website at anakrio.com, including registration, renewal, download and the public API under /api/.
• Anakrio for Windows: the installer, the update and license mechanisms, real-time protection, quarantine and the handling of rule files.
• Integrity of the signature feed and of the installer checksums we publish.

Out of scope

• A specific piece of malware that Anakrio does not detect, or a harmless file it flags. That is a detection problem, not a vulnerability: please use the detection report form.
• Denial-of-service, volumetric or load testing, spam and brute-force traffic.
• Social engineering or phishing of our team or our users, and physical attacks.
• Reports that need an already compromised computer or administrator rights on the victim PC.
• Automated scanner output without a working proof of concept, and missing headers or best-practice settings without a demonstrated impact.
• Third-party services such as our hosting provider, our email provider and the abuse.ch feeds.

What to include

1. A clear description of the issue and why it matters.
2. Step-by-step instructions to reproduce it, ideally with a minimal proof of concept.
3. The affected URL, endpoint or Anakrio version.
4. Your contact details, so we can ask questions and credit you if you wish.

Ground rules

• Only test with your own license and your own data. Do not access, change or delete other people's data.
• Stop as soon as you reach personal data and tell us what you saw. Do not copy or keep it.
• No denial-of-service, spam, social engineering or destructive testing.
• Give us reasonable time to fix the problem before you publish details.