Report a security vulnerability

If you have found something that should not have been possible, we want to know — even if you are not sure, and even if you found it by accident.

1How to report

Send an email to contact@ciron.no. Describe what you found, how you found it, and what you think the consequence is. English or Norwegian, either is fine.

If you need to send something sensitive, say so in your first message, and we will agree on a secure channel before you send it.

2What we promise you

• A reply within one working day. From a person, not a system.
• We will not take legal action against anyone who reports in good faith, follows this page, and has not damaged data or operations.
• You will hear what happens next — what we think of the finding, when we will fix it, and when it has been fixed. Without that, people stop reporting the second time.
• You get the credit if you want it, and stay anonymous if you prefer.

3What belongs here

Everything concerning Nirona: nirona.app and every address under it.

Of particular interest is anything that could let one organisation see another's data, anything that could bypass sign-in, and anything that could make content we have promised is encrypted readable after all.

4What we do not want

• Automated scanner reports where you have not looked at the findings yourself.
• Denial-of-service attacks, or load that affects other customers.
• Access to data that is not yours. If you see an opening, stop — describe it rather than walk through it.
• Social engineering of staff or customers.