Vulnerability Disclosure Policy

Enclave Networks is committed to the security of our products and our customers. We welcome reports from security researchers and members of the broader community who identify vulnerabilities in our systems. This policy describes how to report a vulnerability, what to expect from us, and how we coordinate public disclosure.

Scope

This policy covers the following Enclave systems and products:

• Enclave platform services and infrastructure
• Enclave agents for all supported platforms (Windows, Linux, macOS, Docker, Kubernetes)
• Enclave APIs

If you are unsure whether a system is in scope, report it and we will let you know.

How to report

Please email vulnerability reports to security@enclave.io with a clear description of the issue. If you need to share sensitive details, let us know in your initial email and we will arrange a secure channel.

What to include

A good vulnerability report helps us assess and resolve the issue quickly. Where possible, please include:

• A description of the vulnerability and which system or component is affected
• Steps to reproduce the issue
• Any proof-of-concept code or screenshots
• Your assessment of the potential impact or severity
• Your contact details so we can follow up if we need clarification

Response commitment

We treat every vulnerability report seriously. Our incident response process - including triage timelines, investigation steps, and customer notification commitments - is documented in our security practices. In summary:

• We will acknowledge your report promptly
• We aim to begin triage and initial assessment within hours of receiving a report
• We will keep you informed of our progress as we work toward a resolution

Coordinated disclosure

We follow a coordinated disclosure approach. After receiving your report:

1. We will work to verify and resolve the vulnerability
2. We will coordinate a disclosure timeline with you
3. We ask that you do not share details of the vulnerability publicly until we have had time to investigate, develop a fix, and notify affected customers
4. Once a fix is available and deployed, we will work with you to agree on a public disclosure date

If we are unable to resolve an issue in a reasonable timeframe, we will discuss an appropriate disclosure timeline with you directly.

Bug bounty

At this time we do not operate a bug bounty programme and are unable to offer financial rewards for vulnerability reports.

Safe harbour

Enclave will not pursue legal action against individuals who discover and report security vulnerabilities in good faith, provided they:

• Make a reasonable effort to avoid privacy violations, data destruction, and disruption to our services
• Do not exploit a vulnerability beyond what is necessary to demonstrate it
• Report findings promptly and do not disclose them publicly before we have had an opportunity to address the issue

---

Last updated August 1, 2026