Syncfusion is committed to the privacy, safety, and security of our customers. This policy guides security researchers on our vulnerability disclosure procedures.
For Current Customers
Customers suspecting account compromise or fraud should contact our support team immediately for prompt investigation.
What Constitutes Authorized Research
Acceptable activities when testing our systems include:
- Notifying Syncfusion immediately upon discovery of a vulnerability
- Avoiding privacy violations and system disruption
- Using exploits only to confirm the existence of a vulnerability
- Allowing reasonable resolution time before public disclosure
- Avoiding high-volume, low-quality reports
Prohibited Test Methods
The following approaches are not authorized:
- Use of automated testing tools (without prior written approval)
- Denial of service (DoS/DDoS) attacks
- Physical security testing
- Social engineering tactics targeting Syncfusion staff or customers
Reporting Process
To report a vulnerability, contact our security team by email. Please include detailed vulnerability descriptions, reproduction steps, and proof-of-concept documentation in your submission.
Program Rules
- Only attack accounts you control or have explicit permission to test
- Obtain permission before running automated scanning tools
- Avoid physical and social engineering tests
- No DoS/DDoS exploitation outside controlled environments
- Do not target other users or trade in credentials
Non-Qualifying Issues
Excluded submissions include theoretical issues without proof of concept, HTTP 404 errors, and vulnerabilities exclusively affecting outdated or unsupported browsers.
Authorization
Good-faith compliance with this policy provides legal protection. Syncfusion pledges not to pursue legal action against researchers who follow these guidelines in their security research.