Security and Vulnerability Disclosure

1. Reporting a vulnerability

If you believe you have found a security vulnerability in Recurnix or in our own systems, email security@recurnix.com. Include enough detail to reproduce it. We will acknowledge within 3 working days and keep you updated until it is resolved.

Please give us a reasonable opportunity to fix an issue before disclosing it publicly. We will not take legal action against anyone who reports in good faith, follows this policy and does not access or destroy other people's data.

2. What is in scope

• The Recurnix software itself, in a current version.
• recurnix.com and my.recurnix.com.
• Our licence validation endpoint.

3. What is out of scope

• Findings that require physical access to a device, or a compromised browser.
• Reports produced entirely by an automated scanner with no demonstrated impact.
• Missing best-practice headers where no concrete exploit is shown.
• Social engineering of our staff or customers.
• Denial of service, load testing or brute forcing. Do not do these.
• Vulnerabilities in a customer's own installation, server or configuration. Report those to that operator.

4. How we build

Every release runs an automated test suite before it ships, and the suite includes tests written specifically to stop a fix regressing. Releases are published with a SHA-256 checksum so you can verify what you downloaded.

The distributable archive is inspected by the build itself and is deleted rather than published if it would contain a configuration file, an install lock, cached credentials or repository history. We would rather fail a build than ship a secret.

5. Security features you can use

• Two-factor authentication for staff and for client accounts.
• Role-based permissions, with staff impersonation gated behind its own separate permission.
• An activity log over the records that matter.
• Security headers and a Content-Security-Policy in the shipped configuration.
• Password reset and session invalidation when a sub-user is revoked.

6. Your responsibilities

Because Recurnix is self-hosted, the security of your installation is shared. We are responsible for the software. You are responsible for keeping it updated, for your server, your PHP version, your TLS configuration, your backups and your credentials. An out-of-date installation is the most common way a self-hosted application is compromised.

7. If something happens to us

If we become aware of a breach of our own systems affecting your personal data, we will notify affected customers and, where required, the relevant supervisory authority, without undue delay and in line with the timescales the law sets.