Cordaxis Universal RC Controller

Security policy

Reporting a vulnerability

If you find a security problem in Cordaxis Universal RC Controller, please tell us before telling anyone else.

Include what you can: what you found, how to reproduce it, and what an attacker could do with it. A rough note is better than no note, so do not wait until you have a polished report.

We will confirm we received it within 3 working days.
We will tell you what we think of it within 10 working days.
We will tell you when it is fixed, and credit you if you want.

Please give us 90 days before making it public, or less if we fix it sooner. If the problem is being actively exploited, tell us immediately and we will move faster.

Please do not: run tests against other people's accounts, access data that is not yours, or run denial-of-service tests against the servers. A proof of concept on your own account is enough.

We have no bug bounty programme. We do have gratitude, and we will say so in public if you want us to.

Supported versions

Security fixes go to the latest released version, and each released version is supported for five years from its release.