If you believe you have found a security vulnerability in codygon.com, Tower or Anode, please tell us. We appreciate responsible reports and work with the people who send them to fix issues quickly.

1. Report a Security Issue

Email security@codygon.com with:

  • a description of the issue and the product or URL it affects;
  • the steps needed to reproduce it, with screenshots or a proof of concept if you have them;
  • what you believe an attacker could do with it; and
  • how we can contact you.

Please do not include other people's personal data in your report.

2. Testing Guidelines

When you investigate an issue, please:

  • test only against accounts and data that belong to you;
  • not access, change or delete data that is not yours, and stop as soon as you reach someone else's data;
  • not run tests that could disrupt our services or other users, such as denial-of-service attacks, spam or high-volume automated scanning;
  • not use social engineering, phishing or physical attacks against our staff, offices or customers; and
  • give us reasonable time to fix the issue before you share it with anyone else.

3. What to Expect

  • We acknowledge your report within 5 business days.
  • We keep you informed while we investigate and fix the issue.
  • Once it is fixed, and with your permission, we are happy to credit you for the report.

We do not run a paid bug bounty programme and do not offer payment or other rewards for reports.

Usually out of scope

  • Reports from automated scanners without a demonstrated, exploitable impact.
  • Missing security headers, cookie flags or email settings (such as SPF, DKIM or DMARC) without a working attack.
  • Clickjacking on pages with no sensitive actions.
  • Rate limiting or brute force on pages that do not handle accounts or data.
  • Vulnerabilities in third-party services we use, which should be reported to those vendors.

4. How We Protect Data

  • Encryption: our website and products are served over HTTPS, and Tower encrypts data at rest and in transit.
  • Access control: Tower Enterprise includes single sign-on (SSO), role-based access control and audit logging.
  • Deployment options: Tower Enterprise can be deployed with on-premise components for organisations with data residency or confidentiality requirements.
  • Consent-based tracking: analytics and marketing tools on our website load only after you consent to them.

Certifications

We do not hold third-party security or compliance certifications, such as SOC 2 or ISO/IEC 27001, today. We build controls aligned with the standards our customers need, configure each deployment to the requirements of the customer's industry, and can pursue a specific certification when a customer requires it.

For security questionnaires or documentation, email security@codygon.com.

5. Privacy

Our Privacy Policy explains how we handle personal data. For privacy requests or complaints, email privacy@codygon.com.