RECON ONE legal
Responsible Disclosure Policy
RECON ONE values good-faith security research that helps us identify and address vulnerabilities in systems under our control.
RECON ONE values good-faith security research that helps us identify and address vulnerabilities in systems under our control.
This Responsible Disclosure Policy describes how researchers may report suspected vulnerabilities to Pollux Industries LLC d/b/a RECON ONE.
1. Reporting a Vulnerability
Send an initial report to:
Please include enough information for us to understand and reproduce the issue where reasonably possible, such as:
- the affected RECON ONE asset or URL;
- a description of the vulnerability;
- steps necessary to reproduce the issue;
- potential security impact; and
- relevant technical observations.
For the initial report, do not send:
- passwords;
- authentication tokens;
- private keys;
- unnecessary personal information;
- regulated data;
- customer data;
- full packet captures;
- destructive exploit payloads; or
- large quantities of information obtained from a system.
If additional sensitive evidence is required, RECON ONE may provide an alternative method for transfer.
2. Good-Faith Research
We consider security research to be conducted in good faith when the researcher:
- makes a genuine effort to avoid harm;
- acts for the purpose of identifying and reporting a security vulnerability;
- limits activity to what is reasonably necessary to demonstrate the issue;
- avoids accessing or retaining unnecessary information;
- promptly reports material vulnerabilities;
- does not misuse information obtained during testing; and
- complies with this policy and applicable law.
3. Research Boundaries
Researchers must not:
- intentionally disrupt RECON ONE systems or services;
- conduct denial-of-service or resource-exhaustion attacks;
- destroy, corrupt, alter, or delete data;
- access more information than reasonably necessary to demonstrate a vulnerability;
- download or retain customer information;
- access customer environments;
- perform social engineering, phishing, or physical-security testing;
- introduce malware or persistent access mechanisms;
- use discovered vulnerabilities for extortion or financial leverage;
- publicly disclose exploitable information before RECON ONE has had a reasonable opportunity to investigate and address the issue; or
- test systems or services operated by third parties without their authorization.
Third-party services linked from or used by RECON ONE are not automatically within the scope of this policy.
4. If You Encounter Sensitive Information
If testing unexpectedly exposes customer data, credentials, personal information, confidential information, or other sensitive material:
- stop accessing the affected information;
- do not copy, retain, disclose, or further use the information except to the minimum extent necessary to report the issue; and
- notify RECON ONE through disclosure@recon-one.com.
5. RECON ONE Response
RECON ONE will review reports submitted through the designated disclosure channel and may contact the reporter for additional information.
The time required to investigate or remediate a report depends on factors including severity, complexity, affected systems, third-party dependencies, and operational risk.
Submission of a report does not create a contractual relationship or guarantee payment, recognition, remediation, or a particular response time.
RECON ONE does not currently operate a public bug-bounty program unless expressly stated otherwise.
6. Coordinated Disclosure
We ask researchers to allow RECON ONE a reasonable opportunity to investigate and remediate a reported vulnerability before public disclosure.
Where public disclosure is appropriate, we encourage coordination concerning timing and technical detail so that disclosure does not unnecessarily increase risk to RECON ONE, its customers, or others.
7. Good-Faith Legal Position
RECON ONE does not intend to pursue legal action solely on the basis of good-faith security research that complies with this policy.
This statement does not authorize activity against third-party systems, waive the rights of third parties, or protect conduct that is malicious, extortionate, destructive, unlawful, or materially exceeds the boundaries of this policy.
If you are uncertain whether proposed research is within scope, contact:
before proceeding.
8. No Authorization Beyond This Policy
This policy provides only the limited authorization reasonably necessary to perform good-faith security research on RECON ONE systems that are lawfully within RECON ONE’s control.
It does not authorize testing of:
- customer environments;
- customer systems;
- employee personal accounts or devices;
- third-party infrastructure; or
- systems not owned or controlled by RECON ONE.
9. Changes
RECON ONE may revise this policy as its systems, services, and security processes evolve.
10. Contact
Security reports:
General questions: