Commander is providing this service to help ensure a safe and secure environment for all users. If
external parties find any sensitive information, potential vulnerabilities, or weaknesses, please
help by responsibly disclosing it to ResponsibleDisclosure@fullsteam.com.
This policy applies to Commander-hosted applications and to any other subdomains or services
associated with products. Commander does not accept reports for vulnerabilities that solely
affect marketing websites (www.commanderne.com) containing no sensitive data.
Security researchers must not:
- engage in physical testing of facilities or resources,
- engage in social engineering,
- send unsolicited electronic mail to Commander users, including “phishing”
messages, - execute or attempt to execute “Denial of Service” or “Resource Exhaustion”
attacks, - introduce malicious software,
- execute automated scans or tools that could disrupt services, such as
password guessing attacks, or be perceived as an attack by intrusion
detection/prevention systems, - test in a manner that could degrade the operation of Commander systems; or
intentionally impair, disrupt, or disable Commander systems, - test third-party applications, websites, or services that integrate with or link to
or from Commander systems, - delete, alter, share, retain, or destroy Commander data, or render Commander
data inaccessible, or, - use an exploit to exfiltrate data, establish command line access, establish a
persistent presence on Commander systems, or “pivot” to other Commander
systems.
Security researchers may
- View or store Commander nonpublic data only to the extent necessary to
- document the presence of a potential vulnerability
Security researchers must
- cease testing and notify us immediately upon discovery of a vulnerability,
- cease testing and notify us immediately upon discovery of an exposure of
nonpublic data, and, - purge any stored Commander nonpublic data upon reporting a vulnerability
Thank you for helping to keep Commander and our users safe