Security
Last updated November 2026
Found a security problem in one of our products or sites? Email hello@durendalsystems.com with “Security” in the subject line. I read every report myself.
What's covered
- durendalsystems.com (this site)
- Proofs Cloud at proofs.durendalsystems.com
- Linkwatch at linkwatch.durendalsystems.com
Northmark isn't released yet. Once it is, it will be covered here too.
What to include
- Which product or page is affected, and what an attacker could do.
- Steps to reproduce it, with any requests, screenshots or proof-of-concept code.
- How you'd like to be credited, if at all.
What you can expect
- An acknowledgement within [3 business days], and a first assessment soon after.
- Updates while I work on a fix, and a note when it's released.
- Credit in the release notes if you'd like it.
There's no paid bug bounty at this time.
Testing in good faith
If you follow this page in good faith, I won't pursue legal action against you for your research. Please:
- Only use accounts you own, or test accounts you created, and don't access other people's data.
- Stop and report as soon as you find a problem, rather than exploring further.
- Give me reasonable time to fix it before you share details publicly.
Out of scope: denial-of-service testing, spam, social engineering, physical attacks, and findings in third-party services we use (report those to the vendor).
Machine-readable contact
The same contact details are published at /.well-known/security.txt.