Vulnerability Disclosure
Report a Security Vulnerability
MagiCAD Group welcomes responsible reports of potential security vulnerabilities affecting our products and services.
How to report
Please use one of our official reporting channels:
Primary: Vulnerability and Incident Reporting Portal (account creation required)
- Select Vulnerability Report for a suspected security weakness.
- Select Incident Report if you believe a product security incident or active exploitation is occurring.
Alternative: security-report@magicad.com
What to include
Where possible, include:
- Affected product, service and version
- Description of the vulnerability
- Steps to reproduce the issue
- Potential security impact
- Whether active exploitation is suspected
- Supporting screenshots, logs or a minimal proof of concept
- Contact details for follow-up
Please do not include unnecessary personal data, customer data, credentials or production data.
Responsible testing
Please limit testing to what is necessary to demonstrate the vulnerability.
Do not:
- Perform DoS/DDoS or intentionally disrupt services
- Access, modify or delete data that does not belong to you
- Exfiltrate personal, production or confidential data
- Use phishing, social engineering or physical attacks
- Exploit a vulnerability beyond what is necessary to demonstrate it
- Publicly disclose the vulnerability before coordinating with MagiCAD Group
MagiCAD Group supports security research conducted responsibly and in good faith.
What happens after reporting
We will assess reported vulnerabilities and, where confirmed, prioritise appropriate remediation or mitigation.
We aim to complete an initial triage and severity assessment within 10 business days and provide updates for confirmed vulnerabilities where appropriate.
We ask reporters to allow reasonable time for investigation and remediation before public disclosure.
Bug bounty
MagiCAD Group does not currently operate a bug bounty program and does not provide financial rewards for vulnerability reports.
We appreciate responsible reports that help us improve the security of our products and services.