Security policy

Teichion is a web application firewall that runs inline in your traffic. It is developed and maintained by PhronIQ.

Reporting a vulnerability

Email security@teichion.com. Please do not open a public issue for a security problem.

Include: affected version or commit, component (data plane, control plane, console, Helm chart or compose files), steps to reproduce, and the impact you observed. A proof of concept helps; a working exploit is not required.

What to expect

We aim to acknowledge security reports within three business days; assessment, remediation, and customer-notification timing depend on validated severity and available mitigations.

In scope

  • Bypass of a rule or policy that is documented as blocking a request class, in blocking mode, with the shipped default policy. Include the request and the policy version. Known gaps against the product’s own attack catalog are tracked in the committed allowlist tests/attack-catalog-known-gaps.json — check it before reporting so known let-throughs are not filed twice.
  • Authentication, authorisation or tenant-isolation flaws in the control plane and console.
  • Anything that lets a request crash, stall or disable the data plane, or makes it fail open when it is configured to fail closed.
  • Exposure of secrets: certificate private keys, tokens, credentials.
  • Weaknesses in the published images, Helm chart or compose files as shipped.

Out of scope

  • Findings that need a default development credential or development mode that the documentation tells operators not to use in production.
  • Attacks the product does not claim to stop, including network-layer (L3/L4) denial of service.
  • Reports from automated scanners with no demonstrated impact.
  • Vulnerabilities in third-party components with no demonstrated impact on Teichion; report those upstream and tell us if we should update.
  • Social engineering and physical attacks.

Supported versions

Security fixes and advisories cover the 1.0.x release line.

Coordinated disclosure

We ask for 90 days from your report before public disclosure, or until a fix is released, whichever is sooner. We will credit you in the release notes unless you prefer otherwise. We do not run a paid bounty programme.

What we do not claim

One organisation per install. There is no in-app MFA enrolment in this release. We publish no efficacy, performance or coverage numbers.