Kandji Vulnerability Disclosure

generated: '2026-08-01'
method: searched
probe: true
probe_result: >-
  probe-security-programs.py reported vdp=none — it looks for /.well-known/security.txt and the
  conventional /security/responsible-disclosure, /responsible-disclosure, /vulnerability-disclosure
  paths, none of which Iru uses. The policy was located manually at the non-standard path
  /security/responsible-disclosure-policy and verified by fetch (HTTP 200) on 2026-08-01.
source: https://www.iru.com/security/responsible-disclosure-policy
policy:
- https://www.iru.com/security/responsible-disclosure-policy
contact:
- vdp@iru.com
report_form: https://www.iru.com/security/report-a-potential-security-vulnerability
security_page: https://www.iru.com/security
bug_bounty:
  program: false
  platform: null
  note: >-
    No HackerOne, Bugcrowd or Intigriti program named. Iru handles reports directly through
    vdp@iru.com and its own web form.
safe_harbor:
  published: true
  statement: >-
    "If you make a good faith effort to comply with this document during your security research, we
    will consider your research to be authorized, we will work with you to understand and resolve
    the issue quickly, and Iru will not recommend or pursue legal action related to your research."
timelines:
  acknowledgement: 3 business days
  coordinated_disclosure: 90 days
  post_patch_disclosure: 30 days after a patch is released
  note: Public disclosure at 90 days if unpatched.
researcher_expectations:
- Provide clear and reproducible steps demonstrating the vulnerability.
- Avoid privacy violations, destruction of data, and interruption or degradation of services.
security_testing_program:
  external_pentest: minimum 2 times per year by a qualified third-party firm
  vulnerability_scanning: monthly third-party platform scans plus daily internal scans
  source: https://www.iru.com/security
security_txt:
  published: false
  note: >-
    No /.well-known/security.txt on any Iru host (all 404 on 2026-08-01). Publishing one pointing at
    this policy and vdp@iru.com would be a one-line RFC 9116 win.
x-evidence:
- {fetched: '2026-08-01', url: 'https://www.iru.com/security/responsible-disclosure-policy', http_status: 200, kind: disclosure-policy}
- {fetched: '2026-08-01', url: 'https://www.iru.com/security', http_status: 200, kind: security-page}
- {fetched: '2026-08-01', url: 'https://www.iru.com/.well-known/security.txt', http_status: 404, kind: security.txt}