1. Purpose
EfficientEther Ltd wants to hear about vulnerabilities in its products, so that it can fix them and tell users. This policy explains how to report one and what we commit to in return. It is the single disclosure policy for all EfficientEther products.
2. Products Covered
- EtherApps Forge:
- Forge Anvil
- Forge Capture (
EtherApps_Forge.exe), including the PowerShell module and AppSilo helper - The Forge MSIX engine and CLI (
forge_msix_engine.dll,forge_msix) - The EtherApps MCP server
- Forge installers, update feeds and download pages run by EfficientEther
- EtherInsights: Microsoft 365, Azure and Windows 365 management.
- EtherAssist: secure AI assistance for IT operations, documentation and compliance preparation.
Out of scope:
- Applications that customers package with Forge. Report those to the application's vendor. If Forge's packaging introduced the problem, it is in scope.
- Third-party components. Report them to their maintainers as well; we will pass on what we learn.
- Denial-of-service testing, social engineering, and testing against systems or tenants you do not own.
3. How to Report
Email security@efficientether.co.uk. The security contact is Ryan Mangan, EfficientEther Ltd. Please include:
- the product and version;
- the steps to reproduce, and what an attacker could achieve;
- whether you know of it being exploited;
- how you would like to be credited, if at all.
Please do not report vulnerabilities through public issues, forums or social media. Do not include customer data or credentials in your report.
4. What We Ask of You
- Give us reasonable time to fix the issue before you disclose it publicly.
- Test only against your own installations, tenants, accounts and data.
- Do not access, change or keep other people's data. Do not degrade services, and do not use social engineering.
- Stop and tell us if you reach customer data by accident.
5. What We Commit To
- Acknowledgement: within 5 working days.
- Assessment: an initial assessment and next steps within 15 working days.
- Fixes: security updates provided without delay and free of charge (CRA Annex I Part II(2) and (8)). Where technically feasible, they are delivered through the products' automatic update mechanism.
- Publication: a public advisory once a fix or mitigation is available, with the affected versions, severity and the action users should take. We will credit you if you wish. The default embargo is up to 90 days, adjusted with you case by case.
- Legal reporting: if a vulnerability is actively exploited, we notify the coordinating CSIRT and ENISA through the CRA Single Reporting Platform: an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days of a fix being available (EU Cyber Resilience Act, Regulation (EU) 2024/2847, Article 14). We also inform affected users (Article 14(8)). These duties apply whatever the embargo.
- Third-party components: if the issue is in a component one of our products uses, we report it to that component's maintainer (CRA Article 13(6)).
- Legal action: we will not take legal action against good-faith research that follows this policy.
6. Severity
We assess severity with CVSS v4.0, taking account of how the product is deployed. Severity sets the order of work. It does not change the legal reporting deadlines.
7. Machine-Readable Contact
Our contact details are also published in
security.txt
(RFC 9116). The /.well-known/security.txt addresses of efficientether.co.uk and etherapps.ai lead to the
same file.
8. Changes
This policy is reviewed at least once a year and whenever the reporting process changes.