Skip to main content
Plans: Every plan, and Free. Who: anyone can open the public pages; owners and admins change Settings → Disclosure, and members can view it.
Every workspace has a public disclosure page where researchers, customers and anyone else can report a vulnerability in your products, without signing in. Pharus hosts the report form, your coordinated vulnerability disclosure policy, a privacy notice for reporters, a security.txt file and your published advisories. Every report lands in the disclosure inbox. The CRA asks manufacturers for a coordinated vulnerability disclosure policy and a contact address for reporting vulnerabilities (CRA Annex I, Part II, points (5) and (6)). The disclosure page gives you both.

​
The public pages

All pages live under your company’s slug and need no sign-in. Your slug comes from your company name when the workspace is created. Settings → Disclosure → Public pages shows the exact addresses, each with a copy button and an Open link. The pages are in Norwegian (bokmål) and English. A language switch in the header keeps the reader on the same page. Add ?lang=nb or ?lang=en to a link to choose the language; without it, the pages use the Default language from Settings → Company. An address with an unknown slug shows a short “page wasn’t found” message in both languages, which points the reader to the security.txt on the manufacturer’s website.

​
What researchers see

The report form page opens with “Report a vulnerability” and tells the reader you confirm every report within the number of business days you set. Below that are links to Read the disclosure policy and Security advisories, a link to your OpenPGP key if you set one (“Prefer to encrypt? Use our OpenPGP key”), and “You can also email” with your public contact email if you set one. Under the form, the reader is told the report goes to your security team and that their contact details are used only to handle it, with a link to the privacy notice. After Send report, the reader sees “Thank you. We received your report”, their report number (for example #118) and what happens next:
  • You confirm that you received it within your acknowledgement time.
  • They get an initial assessment within 5 business days.
  • You keep them updated until the vulnerability is fixed or declined, and agree a publication date with them.
If they left an email address, Pharus also sends them an acknowledgement email in the language of the form, with the report number, a link to your policy and a link to the privacy notice. They can reply to it to add details. If they left no address, the page tells them you can’t reply, and that they can send another report with their address and the report number. Send another report starts a new report and keeps their name, email and credit choice.
The thank-you page and the acknowledgement email always promise an initial assessment within 5 business days, as the default policy does. Only the acknowledgement time is a setting.

​
Protections on the form

  • Hidden field. The form has a field people don’t see. A submission that fills it in gets the usual thank-you page, without a report number, and nothing reaches your inbox.
  • Rate limit. One network can send five reports an hour to your page. After that, the form asks the reporter to wait a while or email you instead.
  • No IP addresses stored. For the rate limit, Pharus keeps a keyed hash of the reporter’s IP address, never the address itself, and deletes it after one day.
  • Encrypted reports. If a reporter pastes an OpenPGP-encrypted message, the report is marked OpenPGP encrypted in the inbox and shown as it arrived. Decrypt it with your own key, outside Pharus.

​
Set up the disclosure page

The page works from the day the workspace is created, with the default policy and your company’s security contact. Make it yours before you link to it.
1

Open the settings

Go to Settings → Disclosure. Only owners and admins can change it; members see it read-only.
2

Forward your security mailbox

Copy the address under Inbound address and forward security@ (or whichever mailbox you publish) to it. See Inbound address.
3

Fill in contact and policy

Under Contact and policy, set the public contact email, the acknowledgement time and the other fields described below. Write your own policy and privacy notice, or keep the defaults.
4

Save

Select Save disclosure settings. The public pages and security.txt change straight away.
5

Publish security.txt and link the pages

Put security.txt on your own domain and link the form from your website and product documentation. See Link to the page.

​
Inbound address

Inbound address shows an address of the form r-…@… under Forward to, unique to your workspace. Every email to it becomes a report in the disclosure inbox, and replies you send from Pharus come back to the same report. Use a forwarding rule or an alias on your mail server, so messages arrive with the reporter as the sender. A message someone forwards by hand from their mail program arrives from that person, and Pharus treats them as the reporter. If the address leaks or gets spam, select Rotate address. The current address stops working straight away, so update the forwarding rule on your security mailbox to the new one.

​
Contact and policy

There are no other settings: no embargo period, no languages to choose and no key to upload. The default policy promises to agree a publication date with each reporter.

​
The disclosure policy

The default policy is filled in from your settings and changes when they do. It has these sections:
  • Scope: your active product families, with their firmware, apps and the cloud services they depend on.
  • How to report: the form, your contact email if set, Norwegian or English, and your OpenPGP key if set.
  • What to expect: confirmation within your acknowledgement time, an initial assessment within 5 business days, regular updates, coordinated publication with an advisory when a fix is available, credit if wanted, and a notification to the authorities if the vulnerability is actively exploited.
  • Safe harbour: no legal action against good-faith research within the policy, and the rules for testing.
  • Out of scope: scanner findings without impact, missing headers, denial of service, spam, social engineering and other vendors’ services.
To write your own, select Use the default policy to copy the default into the box, then edit it. A line starting with ## is a heading, a line starting with - is a list item, and a blank line separates paragraphs. Each text can be up to 20 000 characters. Readers get your policy in their language if you wrote one, otherwise in English, otherwise in Norwegian, with a note such as “Nordlys Elektronikk AS has published this policy in English only.” The default appears only when you have written neither. Your own words always win over a translated default.

​
The privacy notice

The privacy notice at /disclose/<your-slug>/privacy tells reporters how their personal data is handled (GDPR Art. 13). Your company is the controller; Pharus is your processor. It is linked from the form, under it, from the footer of every public page and from the acknowledgement email, so reporters who only used email see it too. The default notice covers who is responsible, what is collected, the purpose and legal basis (GDPR Art. 6(1)(f) and 6(1)(c)), who sees the data, how long it is kept, the reporter’s rights and how to complain to Datatilsynet. It names your public contact email for questions, or the form when you have none. Use the default notice copies it into the box for editing. The same language rule applies as for the policy.

​
security.txt

The security.txt card shows the file generated from these settings, with Publish it on your own domain instructions next to it. The CSAF line appears once you publish a TLP:WHITE advisory. See security.txt for the fields and how to serve it from your domain.

​
Link to the page from your website and documentation

  • Your website. Link the form, for example as “Report a vulnerability” in the footer or on your security page, and link the policy. Add ?lang=en for your English pages.
  • security.txt. Serve it at https://<your-domain>/.well-known/security.txt, by redirect or by copying the file. See security.txt.
  • Product documentation. The CRA asks the information for users to include the single point of contact where vulnerabilities can be reported and where your coordinated disclosure policy can be found (CRA Annex II, point 2). Use the form and policy addresses.
  • Advisories. Link https://app.pharussecurity.com/disclose/<your-slug>/advisories where customers look for security updates.
The public pages can’t be embedded in a frame on another site. Link to them instead.

​
On Free

Without a subscription, the disclosure page keeps working: the form, the policy, the privacy notice, security.txt, the advisories page and the inbound address. Owners and admins can still change Settings → Disclosure, and the team can answer reports in the inbox. If an owner closes the workspace, the form shows “Reports are no longer taken here” with your public contact email, if you set one. Email to the inbound address is no longer accepted, and security.txt returns 404. Published advisories stay up until the workspace is deleted. See data and deletion.

Disclosure inbox

Answer and triage the reports that come in.

security.txt

The generated file and how to serve it from your domain.

Security advisories

Publish CSAF/VEX advisories on the same public site.

Plans and features

What keeps working on Free.