Vulnerabilities and incidents
How we keep the service patched, how to tell us about a problem and what we do when something goes wrong.
Vulnerability management and disclosure
Dependencies and images kept current, fixes by severity, and a private way to report a problem.
- Software dependencies and container images are kept up to date, and known vulnerabilities in them are fixed by severity, the most serious first.
- FDIE by Magdox is a hosted service: we apply security updates ourselves and you install nothing. Security advisories about the service, when there are any, go to the owners of affected organisations.
- Anyone can report a security problem in FDIE by Magdox or on magdox.io privately to security@magdox.io. Our responsible disclosure policy sets out what may be tested, how fast we respond and the safe harbour we give good-faith research.
- FDIE by Magdox matches software components against public vulnerability data: the U.S. National Vulnerability Database (NVD), the Open Source Vulnerabilities database (OSV), CISA's Known Exploited Vulnerabilities catalogue and the Exploit Prediction Scoring System (EPSS). We download it daily; no customer data is sent to these sources.
Incident response and breach notice
CERT-In within six hours, and your owners told within 48 hours.
- A cyber security incident is reported to CERT-In within six hours of being noticed, as the CERT-In Directions of 28 April 2022 require.
- A personal data breach affecting your data is notified to your organisation without undue delay and within 48 hours, so that you can meet your own duties, such as notifying an authority within 72 hours under the GDPR or the DPDP Rules. The Data Processing Agreement sets out what the notice contains.
- Our contact for a breach, and our point of contact with CERT-In, is Manish Sharma, Chief Executive Officer, at security@magdox.io.