Common Criteria
Evaluation path open
The protocol implementation is suited to Common Criteria evaluation. Engagement with an evaluation lab will follow when a customer or programme requires it. No evaluation is currently scheduled.
How to report
Email contact@edssa.io. Encrypt sensitive details with our PGP key.
PGP fingerprint: [PLACEHOLDER — to be published]
Scope
In scope:
- The edssa.io marketing site and its API endpoints.
- Any production-facing service we operate at *.edssa.io.
- The reference implementation of the DSSA protocol family, if and when published.
Out of scope:
- Findings from automated scanners without demonstrated impact.
- Vulnerabilities in unrelated third-party services.
- Attempts that disrupt service for other users.
What to expect
- We acknowledge within 48 hours.
- We commit to a 90-day disclosure timeline by default. Coordinated extension on request.
- We credit the reporter publicly once the issue is resolved, unless the reporter prefers to remain anonymous.
Bug bounty
We do not run a paid bug-bounty programme today. We will launch one when deployment volume warrants it. Until then, we acknowledge contributions in our security hall of fame and offer a token of appreciation for material findings.